2026-07-16T01:40:49+02:00 https://nostr.ae Feed of "forgejo/security-announcements" (RSS Feed) https://nostr.ae/npub1cvf3w0q4fzfurxk34l2k8zg9k9nhcnwklswrd5v8me9tfe3jjyvqyfkcea https://codeberg.org/apple-touch-icon.png https://codeberg.org/apple-touch-icon.png https://nostr.ae/nevent1qqs2wj9w82el8cvgfnq99nxt9sxq7necne6v3ed264zu0yv46v3qfzczyrp3x9euz4yf8sv66xha2cufqkckwlzd6m7pcdk3sl0y4d8xx2g3sjtgur6 mfenniak opened issue forgejo/security-announcements#54<br/><br/>54#Forgejo v11.0.15 and v15.0.3#<br/><br/><a href="https://codeberg.org/forgejo/security-announcements/issues/54">https://codeberg.org/forgejo/security-announcements/issues/54</a> 2026-06-03T22:01:51+02:00 https://nostr.ae/nevent1qqs2hmfl4wl9qe8hzxad78s8x8sycmpwxdj89evqdp4fsrkwqauzf5szyrp3x9euz4yf8sv66xha2cufqkckwlzd6m7pcdk3sl0y4d8xx2g3s32hh09 mfenniak opened issue forgejo/security-announcements#53<br/><br/>53#Forgejo v11.0.14 and v15.0.2#<br/><br/><a href="https://codeberg.org/forgejo/security-announcements/issues/53">https://codeberg.org/forgejo/security-announcements/issues/53</a> 2026-05-05T22:07:08+02:00 https://nostr.ae/nevent1qqsy6aj3zlye2q78y9z6nzd8xdmkrrcjtgvlrgfhpn5ckx05zgxzgrczyrp3x9euz4yf8sv66xha2cufqkckwlzd6m7pcdk3sl0y4d8xx2g3strayfq viceice closed issue forgejo/security-announcements#52<br/><br/>Forgejo v11.0.13, v14.0.5, and v15.0.1<br/><br/><a href="https://codeberg.org/forgejo/security-announcements/issues/52#issuecomment-13997294">https://codeberg.org/forgejo/security-announcements/issues/52#issuecomment-13997294</a> 2026-04-29T15:24:34+02:00 https://nostr.ae/nevent1qqsw4w7rfmsy5rra76ez6x2jfj5melz9735e486kxsagwhud0ys7k9gzyrp3x9euz4yf8sv66xha2cufqkckwlzd6m7pcdk3sl0y4d8xx2g3syk2v6n viceice commented on issue forgejo/security-announcements#52<br/><br/>Forgejo v11.0.13, v14.0.5, and v15.0.1<br/><br/><a href="https://codeberg.org/forgejo/forgejo/releases/tag/v11.0.13">https://codeberg.org/forgejo/forgejo/releases/tag/v11.0.13</a>, <a href="https://codeberg.org/forgejo/forgejo/releases/tag/v14.0.5">https://codeberg.org/forgejo/forgejo/releases/tag/v14.0.5</a> and <a href="https://codeberg.org/forgejo/forgejo/releases/tag/v15.0.1">https://codeberg.org/forgejo/forgejo/releases/tag/v15.0.1</a><br/><br/>- Security bug fixes<br/><br/><a href="https://codeberg.org/forgejo/forgejo/pulls/12295">https://codeberg.org/forgejo/forgejo/pulls/12295</a>: When a pull request is opened, the author is able to mark that pull request to &#34;Allow edits from maintainers&#34;, which grants the maintainers of the pull request&#39;s repo access to edit the pull request branch contents. It is possible to create a pull request where the pull request author does not have the ability to edit the pull request branch. Due to a missing security check for this case, maintainers of the pull request repo would be granted the ability to edit the pull request branch, even if the author of the pull request did not have that ability. By exploiting this missing security check, a user can edit any branch in a repository if they&#39;re able to fork that repository. The issue is being fixed by restricting the scope of &#34;Allow edits from maintainers&#34; to only grant that access if the pull request author also had access to edit the branch.<br/><br/><a href="https://codeberg.org/forgejo/security-announcements/issues/52#issuecomment-13997276">https://codeberg.org/forgejo/security-announcements/issues/52#issuecomment-13997276</a> 2026-04-29T15:24:31+02:00 https://nostr.ae/nevent1qqsdkq8mcaygzndjh4wazlmpqh7g6u0atu6nprwvkkhhgftvdsetm5szyrp3x9euz4yf8sv66xha2cufqkckwlzd6m7pcdk3sl0y4d8xx2g3s2jykl5 mfenniak opened issue forgejo/security-announcements#52<br/><br/>52#Forgejo v11.0.13, v14.0.5, and v15.0.1#<br/><br/><a href="https://codeberg.org/forgejo/security-announcements/issues/52">https://codeberg.org/forgejo/security-announcements/issues/52</a> 2026-04-25T19:02:07+02:00