diff --git a/release-notes/9848.md b/release-notes/9848.md
new file mode 100644
index 0000000000..1b3930f3f6
--- /dev/null
+++ b/release-notes/9848.md
@@ -0,0 +1,4 @@
+fix: [commit](https://codeberg.org/forgejo/forgejo/commit/1808b48a4882411677d2c34f6a09714f6692eece) prevent commit API from leaking user's hidden email address on valid GPG signed commits
+fix: [commit](https://codeberg.org/forgejo/forgejo/commit/328a0b4b217ba00418815ef6e7ed3722415d985b) prevent writing to out-of-repo symlink destinations while evaluating template repos
+fix: [commit](https://codeberg.org/forgejo/forgejo/commit/bd89c7f92b87d6df1e48d9595e899072daa0e4d9) prevent .forgejo/template from being out-of-repo content
+fix: [commit](https://codeberg.org/forgejo/forgejo/commit/e3b332fb0e2ff2fdaae8411cd9a91bc268106215) return on error if an LFS token cannot be parsed