Forgejo's security team received disclosure of this issue on September 4th. (source: I am a member of that team)