Forgejo v16.0.5 and v15.0.9 are out, both released on 17 September, and both carry the same two security fixes. The critical one is remote code execution on the host, and the release notes are unusually candid about what makes it interesting: it is a variation of a bug fixed in v15.0.6, and the variation was not caught the first time around.

The patch-apply RCE

When a patch lands in a repository, through the web UI, a web cherry-pick, or the /diffpatch endpoint, Forgejo applies it with git apply --index against a temporary bare repository. An unusual behaviour of git apply lets a crafted patch change arbitrary files around the working directory, and the notes do not dress up the consequence: the behaviour can be abused to perform unexpected operations on the Forgejo host, up to “execution of arbitrary processes” — remote code execution.

The fix moves the apply step into an unrelated temporary directory. Anyone with the rights to apply a patch through those surfaces could have reached it, which is a collaborator-level permission rather than an administrator one. The notes print no affected-version range, so the practical reading is simple: anything older than these two releases is behind.

The CSRF

The second fix is smaller. With OpenID sign-in enabled, a logged-in user can attach an additional OpenID address to their account, and the endpoint that registers it has to be an HTTP GET request because the OpenID specification says so. That shape is what cross-site request forgery feeds on: a page the user visits can fire the same GET, registering an identity they never chose on the account that is currently logged in. An attacker-chosen login method on your account is a sign-in you did not authorize. The fix validates that the request was initiated by the user themselves.

My read

A forge is the quietest root of trust in a self-hosted stack, because it holds the keys that everything else trusts. The bug is the news, but the fix history is the lesson. v15.0.6 closed the vulnerability, and v16.0.5 closes what v15.0.6 did not see. “Fixed” describes the shape that was found, not the class it belonged to, and this is what that gap costs when nobody comes back to look.

Both lines are covered, v15.0.9 for the LTS crowd and v16.0.5 for everyone else, so nobody has a branch to wait on. There is also a new update checker that finally understands LTS releases, which lands somewhere between housekeeping and irony given the week.

Sources: the v16.0.5 and v15.0.9 release notes