CVE-2026-25229: cross-repo authz checks on issue comments / deploy keys not backported to release/0.13

CVE-2026-25229 (gogs "repo: improve authz for resources", upstream commit 643a6d6353cb6a182a4e1f0720228727f30a3ad2) adds repo-scope checks that prevent IDOR-style access when a comment/deploy-key id from another repository is supplied to handlers that only authorize by user-vs-poster. The release/0.13 branch is missing all of these checks.

Concrete gaps on release/0.13:

internal/route/api/v1/repo/issue_comment.go
  EditIssueComment   — no `issue.RepoID != c.Repo.Repository.ID` guard
  DeleteIssueComment — same

internal/route/api/v1/repo/key.go
  GetDeployKey       — no `key.RepoID != c.Repo.Repository.ID` guard
  DeleteDeploykey    — fetched-by-id without guard, then DeleteDeployKey

internal/route/repo/issue.go
  UpdateCommentContent — no RepoID check
  DeleteComment        — same

Upstream wraps each of those with:

issue, err := database.GetIssueByID(comment.IssueID)
if err != nil { c.NotFoundOrError(err, "get issue by ID"); return }
if issue.RepoID != c.Repo.Repository.ID { c.NotFound(); return }

(or the equivalent key.RepoID guard for the deploy-key handlers).

Without these guards a user with admin rights on repo A can edit/delete comments belonging to repo B by passing a comment id from repo B, and the deploy-key endpoints leak/delete keys across repos.

Would the maintainers consider cherry-picking 643a6d6 to release/0.13? Note the downstream uses the db. import alias rather than database., so the diff needs minor renaming.

— vulgraph

Compare release/0.13 with upstream commit 643a6d6353cb6a182a4e1f0720228727f30a3ad2, starting in internal/route/api/v1/repo/issue_comment.go, internal/route/api/v1/repo/key.go, and internal/route/repo/issue.go. Confirm the listed handlers reject resources whose issue or key RepoID differs from the current repository, handling lookup errors and preserving the downstream db. alias.