CVE-2026-89151: Forgejo

Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.

Affected products

• Forgejo Forgejo: from 16.0.0, before 16.0.4 (fixed in 16.0.4); before 15.0.8 (fixed in 15.0.8)

Published 2026-09-11. Last modified 2026-09-22.