Forgejo

8 CVEs across 1 Forgejo products. Browse Forgejo vulnerabilities, severities, and proof-of-concept exploits.

Forgejo products with known CVEs

ProductCVEs
Forgejo8
Forgejo CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-90679Medium4.32026-09-13Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeo…
CVE-2026-89151Low3.52026-09-11Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.
CVE-2026-89094Critical9.92026-09-10Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
CVE-2026-59102Medium5.42026-07-02Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users'…
CVE-2025-689372025-12-26Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symli…
CVE-2023-49948Medium5.32023-12-03Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL.
CVE-2023-49947High7.52023-12-03Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.
CVE-2023-49946Critical9.12023-12-03In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remot…