--- title: Forgejo Security Release 1.18.2-1 | daily.dev description: Forgejo v1.18.2-1 has been released as a security patch fixing a vulnerability that could expose user email addresses. The flaw existed in repository transfer... canonical: https://daily.dev/posts/forgejo-security-release-1-18-2-1-eytdxuphi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Forgejo Security Release 1.18.2-1 | daily.dev og:description: Forgejo v1.18.2-1 has been released as a security patch fixing a vulnerability that could expose user email addresses. The flaw existed in repository transfer... og:url: https://daily.dev/posts/forgejo-security-release-1-18-2-1-eytdxuphi og:image: https://api.daily.dev/og/posts/EyTdxuPHi.png og:image:alt: Forgejo Security Release 1.18.2-1 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Forgejo Security Release 1.18.2-1 **[Forgejo News](https://daily.dev/sources/forgejo)** · 2 min read · 0 upvotes · 0 comments ## Summary Forgejo v1.18.2-1 has been released as a security patch fixing a vulnerability that could expose user email addresses. The flaw existed in repository transfer request notifications sent to organization owner teams, which inadvertently included all members' email addresses. The fix sends individual emails instead and refactors the underlying code. All installations are strongly urged to upgrade immediately. Codeberg is already patched, and the vulnerability details were responsibly disclosed to the Gitea security team on January 21, 2023. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Forgejo 16.0.4 and 15.0.8 address critical security vulnerability](https://daily.dev/posts/forgejo-16-0-4-and-15-0-8-address-critical-security-vulnerability-vhpuap5nt) · LWN.net · 8 upvotes · 1 comments - [Forgejo v13.0 is available](https://daily.dev/posts/forgejo-v13-0-is-available-jokk394fm) · Lobsters · 25 upvotes · 1 comments - [Over 8,300 Gitea servers vulnerable to code execution attacks](https://daily.dev/posts/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks-rbh2jcepp) · BleepingComputer · 1 upvotes · 0 comments - [My Homelab Got Hacked - A Postmortem](https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw) · Lobsters · 1 upvotes · 0 comments - [Hackers now exploit critical Gitea flaw in code injection attacks](https://daily.dev/posts/hackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks-gmz4nkjzi) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#forgejo](https://daily.dev/tags/forgejo), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/forgejo-security-release-1-18-2-1-eytdxuphi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Forgejo Security Release 1.18.2-1","url":"https://daily.dev/posts/forgejo-security-release-1-18-2-1-eytdxuphi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/forgejo-security-release-1-18-2-1-eytdxuphi"},"datePublished":"2026-07-26T07:49:02.459Z","dateModified":"2026-07-30T02:12:59.682Z","description":"Forgejo v1.18.2-1 has been released as a security patch fixing a vulnerability that could expose user email addresses. The flaw existed in repository transfer...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecd9058ec824271361a436684af5bb15?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecd9058ec824271361a436684af5bb15?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Forgejo News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Forgejo News","logo":"https://media.daily.dev/image/upload/s--Cq9uBvkb--/f_auto,q_auto/v1785052096/logos/forgejo?_a=BAMAMicg0","url":"https://daily.dev/sources/forgejo"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/forgejo-security-release-1-18-2-1-eytdxuphi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"forgejo,security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Forgejo News","item":"https://daily.dev/sources/forgejo"},{"@type":"ListItem","position":3,"name":"Forgejo Security Release 1.18.2-1"}]} ```