The self-hosted forge Forgejo shipped versions 16.0.4 and 15.0.8 on September 10 to fix a critical RCE born of template expansion, alongside three authorization flaws that share the same root cause. Everything on 16.0.3 or earlier must be patched, and fine-grained token inventories need a review.
CVE-2026-60004, a critical code-injection flaw in Gitea, has been exploited in the wild since August 25, 2026: an attacker can run shell commands as the forge’s system user. Self-hosted instances with open registration are hit first; the fix comes down to an upgrade and a disable switch.
On August 2, 2026, Gitea shipped a critical fix for CVE-2026-59774, a path traversal that lets an unauthenticated attacker read any server file via Org-mode markup rendering on a public repository. Worse: by reading the INTERNAL_TOKEN from app.ini, the attacker can escalate to remote code execution. Every self-hosted Gitea administrator must patch and rotate secrets immediately.
Forgejo shipped version 16.0 on July 16, 2026, three and a half years after the community fork from Gitea. A single 100 MB Go binary replaces both GitHub and GitLab on the cheapest VPS money can buy, with GitHub Actions-compatible CI/CD and governance locked under a non-profit foundation.
