Forgejo
Dev & CI/CD · products/forgejo.yaml · RSS
Latest 17.0.0 Oct 15, 2026
Latest per track
| Track | Latest | Released |
|---|---|---|
| 15 (LTS) | 15.0.10 | Oct 12, 2026 |
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 17.0 | 17.0.0 | Oct 15, 2026 | Jan 28, 2027 · maintained |
| 16.0 | 16.0.6 | Jul 16, 2026 | Oct 29, 2026 · maintained |
| 15.0 LTS | 15.0.10 | Apr 16, 2026 | Jul 15, 2027 · maintained |
| 14.0 | 14.0.5 | Jan 15, 2026 | Apr 30, 2026 · ended |
| 13.0 | 13.0.5 | Oct 16, 2025 | Jan 29, 2026 · ended |
| 12.0 | 12.0.4 | Jul 17, 2025 | Oct 16, 2025 · ended |
| 11.0 LTS | 11.0.16 | Apr 16, 2025 | Jul 16, 2026 · ended |
| 10.0 | 10.0.3 | Jan 16, 2025 | Apr 16, 2025 · ended |
| 9.0 | 9.0.3 | Oct 16, 2024 | Jan 16, 2025 · ended |
| 8.0 | 8.0.3 | Jul 30, 2024 | Oct 16, 2024 · ended |
| 7.0 LTS | 7.0.16 | Apr 23, 2024 | Jul 17, 2025 · ended |
Recent releases
Security advisories
9.1 CVE-2023-49946 In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, re…
7.5 CVE-2023-49947 Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.
5.3 CVE-2023-49948 Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL.