Is that linked submission "your experience" or is there something else you're basing that on? Because that article you linked is kind of strange, read through the comments on what you linked.

Forgejo's security team received disclosure of this issue on September 4th. (source: I am a member of that team)