Quick answers
- Is CVE-2026-89151 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-89151 being exploited in the wild.
- How severe is CVE-2026-89151?
- Low severity, with a CVSS score of 3.5, published 11 September 2026.
- Which products and versions are affected?
- Forgejo before 16.0.4.
- Is there a fix for CVE-2026-89151?
- A patch was published on 2026-09-11: Fixed in Forgejo 16.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-89151 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-89151?
- Check whether you run Forgejo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass in Forgejo's API when editing repository contents through pull requests. When a pull request has the "allow maintainer edit" option enabled, a specialized security control permits repository maintainers to edit branches they do not own. However, this control failed to account for API-specific security restrictions such as repository-scoped access tokens with limited permissions. An attacker with a restricted API token could exploit this to make modifications beyond the token's intended scope. The fix involved updating the authorization reducer to properly evaluate API authentication security restrictions when checking editable pull requests.
Affected products
- Forgejo Forgejo before 16.0.4
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Fixed in Forgejo 16.0.4