RE: https://floss.social/@forgejo/116652655395588085 To clarify what is going on here in detail while keeping it in a single post, the "vulnerability" as disclosed is that a package which is uploaded to a public user or organization and linked to a private repository remains public. This behavior is, in fact, intended. Forgejo's package registry stores packages under the user/organization namespace, and packages inherit their visibility from the user or organization they are uploaded to. The ability to link a package to a given repository is only for cosmetic purposes within Forgejo's UI. The team respects that some users would appreciate more flexibility w.r.t. package visibility, but this falls under the category of "feature request", not "vulnerability". If you wish to host a private package registry, you have the option to upload your packages to a private organization or host an in-house instance for use as a private package registry. The next patch release will also include a warning about this in the UI for private repositories that use packages.