CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4 with [federation] ENABLED = true contains a signature-spoofing flaw in its ActivityPub inbox processing. The HTTP Signature verification in routers/api/v1/activitypub/reqsignature.go validates the request, but inbox handlers then read the acting identity from the att...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

EUVD-2026-76944

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2025-68937

CVE-2025-68937 - RCE por Symlink en Plantillas de Gitea/Forgejo Prueba de concepto automatizada para CVE-2025-68937 : salto de directorio mediante el seguimiento de enlaces simbólicos en el procesamiento de repositorios plantilla de Gitea y Forgejo, que conduce a la ejecución remota de código...

CVE-2026-89151

A flaw was found in Forgejo. A remote attacker with low privileges could exploit this vulnerability by using restricted API tokens. This allows for unintended access to the "allow maintainer edit" feature, potentially leading to unauthorized modifications. Mitigation Mitigation for this issue is...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

EUVD-2026-75922

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

CVE-2026-89151

Forgejo before 16.0.4 is affected by a vulnerability allowing restricted API tokens to be used for unintended access to the "allow maintainer edit" feature. The CVSS 3.1 score is 3.5 (LOW) , with a vector of AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N, indicating a network attack requiring low privileges...

PT-2026-89744

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

Gitea-Forgejo-CVE-2025-68937

Vulnerabilidad de expansión arbitraria de plantillas en Gitea y Forgejo Este trabajo está licenciado bajo una Licencia Creative Commons Atribución-CompartirIgual 4.0 Internacional. Resumen Al revisar el código fuente de Forgejo y Gitea para entender mejor cómo se realiza el templating, descubrí u...

CVE-2026-89094

Forgejo versions prior to 16.0.4 are vulnerable to remote code execution (RCE) when a user creates a crafted template repository. The root cause is mishandled template expansion on files located in the .forgejo/template directory, which allows an attacker with low privileges to achieve code execu...

CVE-2026-89094

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

EUVD-2026-75732

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

research-cve-2025-68971

CVE 2025-68971 | Investigación de Conocimiento de Holloway Chew, Kean Ho El 22 de diciembre de 2025, se descubrió una vulnerabilidad de seguridad CVE 2025-68971 CVSS: 5.5/MEDIUM en la aplicación de código abierto Forgejo 13.0.3, detectada por primera vez en el sistema operativo FreeBSD14. Provocó...

PT-2026-89589

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

CVE-2026-60004

CVE-2026-60004 — Gitea Diffpatch Git Hook RCE Bare Clone Hook Injection → post-index-change → Arbitrary Command Execution Overview CVE-2026-60004 is a critical-severity CVSS 9.8 pre-authentication remote code execution vulnerability in Gitea and Forgejo self-hosted Git platforms, affecting versio...

CVE-2024-45337

Exploit de prueba de concepto para CVE-2024-45337 Este repositorio contiene un exploit de prueba de concepto para CVE-2024-45337. Se puede utilizar para envolver ssh al interactuar con un servidor SSH implementado con golang.org/x/crypto = v0.30.0., mientras se almacenan en caché los permisos en ...

CVE-2026-82556

A flaw was found in Forgejo. A remote attacker could exploit a server-side request forgery SSRF vulnerability by manipulating the net.LookupIP function within the Repository Migration Handler. This could allow the attacker to force the server to make requests to arbitrary network resources,...