EUVD-2026-76944

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

PT-2026-90787

Name of the Vulnerable Software and Affected Versions Forgejo versions 13.0.0 through 16.0.4 Description An identity spoofing issue exists when federation ENABLED = true is configured. The system fails to verify that the HTTP Signature of an incoming ActivityPub activity was generated by the key...

CVE-2026-90679: Use of Less Trusted Source

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-89151

A flaw was found in Forgejo. A remote attacker with low privileges could exploit this vulnerability by using restricted API tokens. This allows for unintended access to the "allow maintainer edit" feature, potentially leading to unauthorized modifications. Mitigation Mitigation for this issue is...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

EUVD-2026-75922

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

CVE-2026-89151

Forgejo before 16.0.4 is affected by a vulnerability allowing restricted API tokens to be used for unintended access to the "allow maintainer edit" feature. The CVSS 3.1 score is 3.5 (LOW) , with a vector of AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N, indicating a network attack requiring low privileges...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

CVE-2026-89151: Incorrect Authorization

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

PT-2026-89744

Name of the Vulnerable Software and Affected Versions Forgejo versions prior to 16.0.4 Description Restricted API tokens can be used to gain unauthorized access to the "allow maintainer edit" feature. Recommendations Update to version 16.0.4 or later...

CVE-2026-89094

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

CVE-2026-89094

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

CVE-2026-89094

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

CVE-2026-89094

Forgejo versions prior to 16.0.4 are vulnerable to remote code execution (RCE) when a user creates a crafted template repository. The root cause is mishandled template expansion on files located in the .forgejo/template directory, which allows an attacker with low privileges to achieve code execu...

EUVD-2026-75732

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

CVE-2026-89094: Improper Neutralization of Special Elements Used in a Template Engine

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

PT-2026-89589

Name of the Vulnerable Software and Affected Versions Forgejo versions prior to 16.0.4 Description Remote code execution is possible through the use of a crafted template repository. This occurs because the software mishandles template expansion on files located within the .forgejo/template...

CVE-2026-82556

A flaw was found in Forgejo. A remote attacker could exploit a server-side request forgery SSRF vulnerability by manipulating the net.LookupIP function within the Repository Migration Handler. This could allow the attacker to force the server to make requests to arbitrary network resources,...