Forgejo vulnerabilities

Products

• Forgejo 12

Newest

• forgejo Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id} CVE-2026-119547 5.3 MediumOctober 30, 2026
• forgejo Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo CVE-2026-119546 6.8 MediumOctober 30, 2026
• forgejo Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery CVE-2026-119545 6.9 MediumOctober 30, 2026
• forgejo Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue... CVE-2026-90679 4.3 MediumSeptember 13, 2026
• forgejo Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow... CVE-2026-89151 3.5 LowSeptember 11, 2026
• forgejo Forgejo before 16.0.4 allows remote code execution via a crafted template repository because... CVE-2026-89094 9.9 CriticalSeptember 10, 2026
• forgejo Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery CVE-2026-82556 5.3 MediumAugust 30, 2026
• forgejo Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering CVE-2026-59102 2.1 LowJuly 2, 2026
• forgejo Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server... CVE-2025-68937 Public exploit 9.5 CriticalDecember 25, 2025
• forgejo Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user... CVE-2023-49948 5.3 MediumDecember 3, 2023
• forgejo Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. CVE-2023-49947 7.5 HighDecember 3, 2023
• forgejo In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a... CVE-2023-49946 9.1 CriticalDecember 3, 2023