CVE-2026-89151

EUVD-2026-75922
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
3.5 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 13.79%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
forgejoforgejo
16.0.0 ≤
𝑥
< 16.0.4
CNA
forgejoforgejo
𝑥
< 15.0.8
CNA
Common Weakness Enumeration
References
https://codeberg.org/forgejo/forgejo/milestone/139655
https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.8.md