Description
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Forgejo | Forgejo | 16.0.0 – < 16.0.4, < 15.0.8 | 16.0.4 |
Low · 3.5
CVE-2026-89151
EUVD-2026-75922GHSA-jxfm-4h2p-76mq
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.
Published Sep 11, 2026 · Updated Sep 11, 2026 · Assigned by mitre