API Token Misuse Vulnerability in Forgejo by Codeberg
CVE-2026-89151

3.5LOW

Key Information:

Vendor

Forgejo

Status
Forgejo
Vendor
CVE Published:
11 September 2026

What is CVE-2026-89151?

A vulnerability in Forgejo prior to version 16.0.4 allows the misuse of restricted API tokens, which can lead to unauthorized access to the 'allow maintainer edit' feature. This oversight can enable attackers to manipulate user permissions, potentially compromising sensitive project management operations.

Affected Version(s)

Forgejo 16.0.0 < 16.0.4

Forgejo 0 < 15.0.8

References

https://codeberg.org/forgejo/forgejo/milestone/139655
https://codeberg.org/forgejo/forgejo/src/branch/forgejo/r...

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.