Forgejo shipped emergency security releases 16.0.4 and 15.0.8 on September 10, 2026, closing a critical remote code execution vulnerability in the feature that creates a new repository from a template. The project announced both versions on its official Codeberg repository and on its Fediverse account, describing the fix as critical. Any self-hosted instance running 16.0.3 or earlier on the stable branch, or 15.0.7 or earlier on the LTS branch, is vulnerable and should be updated without delay.
What was fixed
The release notes list two security fixes. The first is a critical remote code execution vulnerability, tracked as CVE-2026-89094 and rated 9.9 out of 10 on the CVSS scale, just below the maximum possible severity. The second is a narrower authorization bypass affecting the API. Both issues are resolved in 16.0.4, the current stable release, and backported to 15.0.8, the long-term support branch that receives security-only updates.
How the repository template RCE works
Forgejo lets any user with repository-creation rights spin up a new repository from an existing template, a convenience feature that on many instances is available to every registered account, not just admins. Creating a repository from a template runs through four steps behind the scenes:
- Clone the template repository.
- Delete the cloned copy’s .git folder.
- Expand any template variables found in files under a .forgejo/template path.
- Run git init to turn the result into a fresh repository.
The variable-expansion step is where the vulnerability lives. A malicious template can be built so that expanding its variables recreates a full .git folder, hooks subdirectory included, with executable scripts inside. When Forgejo then runs git init, Git finds that .git folder already sitting there and adopts it instead of creating a clean one. The hook scripts are now live, and they run with the privileges of the Forgejo service account the next time a matching Git action fires. A booby-trapped template can achieve remote code execution as soon as someone uses it to create a repository.
The fix is narrow: Forgejo now deletes any .git folder that reappears after variable expansion, before git init runs. That closes the path an attacker would need to plant hooks on the server.
A second fix: API permission bypass
The same releases patch an authorization gap in Forgejo’s API. Forgejo has a permission check that lets repository maintainers edit branches they don’t own when a pull request has “allow maintainer edits” turned on. That check wasn’t accounting for API-specific restrictions, including repository-scoped access tokens. A token deliberately limited to narrow, repo-scoped permissions could be used to make changes outside that scope. That defeats the purpose of scoping the token down in the first place.
Who’s affected, and what to do
Forgejo 16.0.3 and earlier on the stable branch, and 15.0.7 and earlier on the LTS branch, are both vulnerable. The fixes ship in 16.0.4 (stable) and 15.0.8 (LTS). Triggering the flaw doesn’t require admin access, so if ordinary users on your instance can create repositories from templates, which is the default in many self-hosted setups, treat this as an update to apply today rather than at the next scheduled maintenance window.
Forgejo began in 2022 as a community-driven hard fork of Gitea, and the two projects are often mentioned together. For this specific issue, though, the vulnerable code is Forgejo’s own: the .forgejo/template convention used during variable expansion doesn’t exist in Gitea’s codebase. Gitea’s own recent release notes don’t list a matching fix, so there’s no confirmed evidence that Gitea shares this particular vulnerability. If you run Gitea rather than Forgejo, there’s nothing to act on based on this advisory specifically, though keeping any Git hosting platform current is always good practice.
Getting the update
Forgejo 16.0.4 and 15.0.8 are available now from the project’s official releases page on Codeberg, and through forgejo.org. As with any security release, back up your instance before upgrading, and check the full changelog for anything else bundled into the update.
selfhostlab.io covered Forgejo’s move to version 16.0 back in July, including the SSRF hardening and notification changes in that release. It’s worth a look for background on what’s changed since, now that this security follow-up has landed.