Feed of "forgejo/security-announcements" (RSS Feed)

Watch this repository or subscribe to the RSS feed to get advance warning of security releases. They will not reveal the details of the vulnerability but allow Forgejo admins to plan ahead and better secure their instance.

https://codeberg.org/forgejo/security-announcements

Last Notes

2026-06-03 22:01:51 CEST

mfenniak opened issue forgejo/security-announcements#54
54#Forgejo v11.0.15 and v15.0.3#
https://codeberg.org/forgejo/security-announcements/issues/54

2026-05-05 22:07:08 CEST

mfenniak opened issue forgejo/security-announcements#53
53#Forgejo v11.0.14 and v15.0.2#
https://codeberg.org/forgejo/security-announcements/issues/53

2026-04-29 15:24:34 CEST

viceice closed issue forgejo/security-announcements#52
Forgejo v11.0.13, v14.0.5, and v15.0.1
https://codeberg.org/forgejo/security-announcements/issues/52#issuecomment-13997294

2026-04-29 15:24:31 CEST

viceice commented on issue forgejo/security-announcements#52
Forgejo v11.0.13, v14.0.5, and v15.0.1
https://codeberg.org/forgejo/forgejo/releases/tag/v11.0.13, https://codeberg.org/forgejo/forgejo/releases/tag/v14.0.5 and https://codeberg.org/forgejo/forgejo/releases/tag/v15.0.1
- Security bug fixes
https://codeberg.org/forgejo/forgejo/pulls/12295: When a pull request is opened, the author is able to mark that pull request to "Allow edits from maintainers", which grants the maintainers of the pull request's repo access to edit the pull request branch contents. It is possible to create a pull request where the pull request author does not have the ability to edit the pull request branch. Due to a missing security check for this case, maintainers of the pull request repo would be granted the ability to edit the pull request branch, even if the author of the pull request did not have that ability. By exploiting this missing security check, a user can edit any branch in a repository if they're able to fork that repository. The issue is being fixed by restricting the scope of "Allow edits from maintainers" to only grant that access if the pull request author also had access to edit the branch.
https://codeberg.org/forgejo/security-announcements/issues/52#issuecomment-13997276

2026-04-25 19:02:07 CEST

mfenniak opened issue forgejo/security-announcements#52
52#Forgejo v11.0.13, v14.0.5, and v15.0.1#
https://codeberg.org/forgejo/security-announcements/issues/52