Forgejo EUVD-2026-75922

Exploitation requires an authenticated Forgejo user (PR:L) who holds a restricted (scoped) API token - the bypass is only meaningful when token scope restrictions are configured and the enforcement gap applies. The attacker must have sufficient repository standing to open or interact with pull requests in order to target the maintainer-edit setting. AC:H indicates additional specific conditions beyond baseline network access are required, likely a particular token configuration or PR state. Limiting factors: full authentication required, high attack complexity, and impact is confined solely to toggling the 'allow maintainer edit' PR flag (I:L, no confidentiality or availability impact). Unauthenticated exploitation is not possible per the CVSS PR:L metric.

CVSS 3.5 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N. The low base score is consistent with the narrow actual impact: the attacker can toggle the 'allow maintainer edit' setting on pull requests, which is an integrity-only change (I:L) with no confidentiality or availability consequence. AC:H signals that exploitation requires specific conditions - most likely the attacker must hold a restricted API token and target a repository where they have standing to open or interact with PRs. No EPSS score is provided in the input data, and the CVE is not listed in CISA KEV, so no evidence of active or widespread exploitation exists. No public exploit has been identified. Real-world risk is low: the attacker must be authenticated (PR:L), exploitation conditions are narrow (AC:H), and the worst realistic outcome is enabling unauthorized maintainer write access to a PR source branch - a meaningful but bounded integrity issue unlikely to serve as a standalone kill chain.

An authenticated Forgejo user holding a restricted-scope API token sends an API request to the pull-request maintainer-edit endpoint. Because the authorization check does not properly validate the token's scope restrictions, the request succeeds and the attacker enables 'allow maintainer edit' on a PR they control, granting maintainers of the target repository write access to the attacker's source branch in ways the restricted token was never intended to permit. No public exploit code exists at time of analysis, and AC:H indicates specific conditions must align for the bypass to succeed.