Live › vulnerability › CVE-2026-119547
Forgejo's GetPublicKey API handler skips an ownership check on key lookups, so any authenticated user can enumerate sequential key IDs. An attacker gets titles, fingerprints and public key material for other users' SSH, deploy and principal keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Instances of Forgejo in the affected version ranges are exposed to any signed-in user holding a read:user token or session. Self-hosted instances where many users or external accounts can log in are the most exposed; single-user instances are much less so. Instances on versions outside the listed ranges are not affected.
No product ranges from the sources yet.
forgejo --version or the server's admin dashboard.15.0.11 and earlier, 16.0.0 through 16.0.7, or 17.0.0 through 17.0.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.
This page as .md · .json · in your agent: get_signal("CVE-2026-119547")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.