CVE-2026-89151 Forgejo CVE debrief

Who should care

Defenders managing Forgejo instances, maintainers of code repositories, and those responsible for vulnerability management should assess exposure and prioritize remediation based on their deployment context.

Why it matters

CVE-2026-89151 is a low-severity vulnerability in Forgejo that requires verification of affected versions and remediation priority based on deployment context.

• Verification of affected Forgejo versions is required
• Remediation priority should be set based on deployment context
• Monitoring for potential misuse of restricted API tokens is necessary
• Limited impact on code repository management is possible

Technical summary

The vulnerability allows the use of restricted API tokens for unintended access to the 'allow maintainer edit' feature in Forgejo before version 16.0.4. This could potentially lead to limited impact on code repository management. Defenders should verify if their Forgejo instances are affected and prioritize remediation based on their deployment context, considering verification of affected versions and remediation priority. It requires verification of affected Forgejo versions and remediation priority based on deployment context, with monitoring for potential misu

Defensive priority

Defenders should verify if their Forgejo instances are affected and prioritize remediation based on their deployment context.

Recommended defensive actions

• Verify if the Forgejo instance is affected by checking the version
• Assess exposure based on deployment context
• Prioritize remediation based on the low-severity impact
• Monitor for potential misuse of restricted API tokens

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine affected versions and remediation steps.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.