# CVE-2026-89151: Forgejo authorization bypass in API pull request editing

Source: https://junglewise.ai/threats/cve-2026-89151-forgejo-authorization-bypass-in-api-pull-request-editing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89151 · Severity: low · CVSS 3.5 · Published 2026-09-11

Forgejo is a Git repository hosting platform. A flaw in its API allowed users with restricted access tokens to bypass security controls and edit pull requests that they should not have permission to modify, specifically leveraging the "allow maintainer edit" feature intended only for authorized maintainers. This could enable unauthorized code changes to be merged into repositories.

Technologies: [Forgejo](https://junglewise.ai/threats/technologies/forgejo). Vendors: [Forgejo](https://junglewise.ai/threats/vendors/forgejo).

## Quick answers

**Is CVE-2026-89151 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89151 being exploited in the wild.

**How severe is CVE-2026-89151?** Low severity, with a CVSS score of 3.5, published 11 September 2026.

**Which products and versions are affected?** Forgejo before 16.0.4.

**Is there a fix for CVE-2026-89151?** A patch was published on 2026-09-11: Fixed in Forgejo 16.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89151 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-89151?** Check whether you run Forgejo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in Forgejo's API when editing repository contents through pull requests. When a pull request has the "allow maintainer edit" option enabled, a specialized security control permits repository maintainers to edit branches they do not own. However, this control failed to account for API-specific security restrictions such as repository-scoped access tokens with limited permissions. An attacker with a restricted API token could exploit this to make modifications beyond the token's intended scope. The fix involved updating the authorization reducer to properly evaluate API authentication security restrictions when checking editable pull requests.

## Affected products

- Forgejo Forgejo before 16.0.4

## Timeline

- 2026-09-11: disclosed
- 2026-09-11: patched: Fixed in Forgejo 16.0.4

## References

- [https://codeberg.org/forgejo/forgejo/milestone/139655](https://codeberg.org/forgejo/forgejo/milestone/139655)
- [https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.8.md](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.8.md)

## Related threats

- [Forgejo GetPublicKey API information disclosure](https://junglewise.ai/threats/cve-2026-119547-forgejo-through-15-0-11-16-0-0-through-16-0-7-and-17-0-0-through)
- [Forgejo path traversal in restore-repo](https://junglewise.ai/threats/cve-2026-119546-forgejo-through-15-0-11-16-0-0-through-16-0-7-and-17-0-0-through)
- [Forgejo server-side request forgery in OpenID discovery](https://junglewise.ai/threats/cve-2026-119545-forgejo-through-15-0-11-16-0-0-through-16-0-7-and-17-0-0-through)
- [Forgejo ActivityPub identity spoofing via unbound HTTP signature](https://junglewise.ai/threats/cve-2026-90679-forgejo-activitypub-identity-spoofing-via-unbound-http-signature)
- [Forgejo remote code execution in template expansion](https://junglewise.ai/threats/cve-2026-89094-forgejo-remote-code-execution-in-template-expansion)