{"id":"CVE-2026-119547","kind":"vulnerability","aliases":["CVE-2026-119547"],"related":[],"title":"Forgejo: key lookup lets signed-in users read other users' SSH keys","description":"Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.","summary":"Forgejo's GetPublicKey API handler skips an ownership check on key lookups, so any authenticated user can enumerate sequential key IDs. An attacker gets titles, fingerprints and public key material for other users' SSH, deploy and principal keys.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forgejo","git","package","self-hosted"],"not_affected_if":["single-user-instance","version-outside-range"],"how_to_check":"- Check the installed Forgejo version with `forgejo --version` or the server's admin dashboard.\n- Confirm whether the instance is on a version in the affected ranges: `15.0.11` and earlier, `16.0.0` through `16.0.7`, or `17.0.0` through `17.0.1`.","fix":"- Forgejo 15.x: unknown (sources give no fixed version in this range)\n- Forgejo 16.x: unknown (sources give no fixed version in this range)\n- Forgejo 17.x: unknown (sources give no fixed version in this range)","status":"open","published_at":"2026-10-30T12:16:40+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:32:57+00:00","updated_at":"2026-10-30T12:32:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T12:32:57Z","model":"claude-haiku-5-5","output":{"fix":"- Forgejo 15.x: unknown (sources give no fixed version in this range)\n- Forgejo 16.x: unknown (sources give no fixed version in this range)\n- Forgejo 17.x: unknown (sources give no fixed version in this range)","reach":"network","title":"Forgejo: key lookup lets signed-in users read other users' SSH keys","impact":"low","summary":"Forgejo's GetPublicKey API handler skips an ownership check on key lookups, so any authenticated user can enumerate sequential key IDs. An attacker gets titles, fingerprints and public key material for other users' SSH, deploy and principal keys.","audience":"businesses","category":"package","nicknames":[],"who_cares":["forgejo","self-hosted","git"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"other users' public SSH and deploy keys readable by any account","analyst_note":"Confirm the fixed Forgejo versions for the 15.x, 16.x and 17.x branches from the Forgejo security advisory, which the NVD entry does not list.","how_to_check":"- Check the installed Forgejo version with `forgejo --version` or the server's admin dashboard.\n- Confirm whether the instance is on a version in the affected ranges: `15.0.11` and earlier, `16.0.0` through `16.0.7`, or `17.0.0` through `17.0.1`.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range","single-user-instance"],"who_is_affected":"Instances of Forgejo in the affected version ranges are exposed to any signed-in user holding a read:user token or session. Self-hosted instances where many users or external accounts can log in are the most exposed; single-user instances are much less so. Instances on versions outside the listed ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000754,"input_tokens":4184,"output_tokens":672,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119547':16A,19A '-2026':15A,18A '15.0.11':66C '16.0.0':67C '16.0.7':69C '17.0.0':71C '17.0.1':73C 'api':29B,82C 'attack':48B 'authent':40B,92C 'check':34B,88C 'contain':74C 'cve':14A,17A 'deploy':60B,118C 'disclosur':77C 'enumer':43B,102C 'fingerprint':51B,109C 'forgejo':1A,20B,26B,64C 'get':49B 'getpublickey':28B,81C 'git':21B 'handler':30B,83C 'host':25B 'id':46B,105C 'inform':76C 'key':2A,13A,36B,45B,54B,63B,90C,104C,112C,121C 'lack':85C 'let':4A 'lookup':3A,37B,91C 'materi':55B,113C 'obtain':107C 'ownership':33B,87C 'packag':22B 'princip':62B,120C 'public':53B,111C 'read':9A,96C 'self':24B 'self-host':23B 'sequenti':44B,103C 'session':100C 'sign':6A 'signed-in':5A 'skip':31B 'ssh':12A,59B,117C 'titl':50B,108C 'token':98C 'user':8A,11A,41B,58B,93C,97C,116C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Instances of Forgejo in the affected version ranges are exposed to any signed-in user holding a read:user token or session. Self-hosted instances where many users or external accounts can log in are the most exposed; single-user instances are much less so. Instances on versions outside the listed ranges are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119547","severity":null,"published_at":"2026-10-30T12:16:40+00:00","modified_at":"2026-10-30T12:16:41+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}