EUVD-2026-75922
GHSA-jxfm-4h2p-76mq
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Network API call requires specific restricted-token conditions (AC:H), authenticated low-privilege attacker (PR:L), scope escapes token boundary (S:C), integrity-only impact on PR settings (I:L).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.
AnalysisAI
Restricted API token authorization bypass in Forgejo before 16.0.4 (and before 15.0.8 on the 15.x branch) allows authenticated users holding limited-scope tokens to invoke the 'allow maintainer edit' pull-request feature beyond those tokens' intended permissions. The flaw is CWE-863 Incorrect Authorization: the endpoint responsible for toggling maintainer-edit access on PRs fails to enforce token scope boundaries, permitting a scoped token to reach an operation it should be barred from. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Forgejo user (PR:L) who holds a restricted (scoped) API token - the bypass is only meaningful when token scope restrictions are configured and the enforcement gap applies. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.5 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Forgejo to version 16.0.4 or later on the 16.x branch, or to 15.0.8 or later on the 15.x branch, as documented in the Codeberg milestone (codeberg.org/forgejo/forgejo/milestone/139655) and the 15.0.8 release notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissio
Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. Rated high severity (CVSS 7.5), t
Server-side request forgery in Forgejo up to 15.0.4 allows authenticated users to bypass the repository migration IP all
Stored XSS in Forgejo before 15.0.3 allows authenticated users to execute arbitrary JavaScript in other users' browsers
Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or
Identity spoofing in Forgejo's ActivityPub federation allows a remote attacker who controls any single valid ActivityPub
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today