Executive brief
Forgejo is a Git repository hosting platform. A flaw in its API allowed users with restricted access tokens to bypass security controls and edit pull requests that they should not have permission to modify, specifically leveraging the "allow maintainer edit" feature intended only for authorized maintainers. This could enable unauthorized code changes to be merged into repositories.
Technical details
The vulnerability is an authorization bypass in Forgejo's API when editing repository contents through pull requests. When a pull request has the "allow maintainer edit" option enabled, a specialized security control permits repository maintainers to edit branches they do not own. However, this control failed to account for API-specific security restrictions such as repository-scoped access tokens with limited permissions. An attacker with a restricted API token could exploit this to make modifications beyond the token's intended scope. The fix involved updating the authorization reducer to properly evaluate API authentication security restrictions when checking editable pull requests.
Affected products
- Forgejo Forgejo before 16.0.4
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Fixed in Forgejo 16.0.4