---
id: "CVE-2026-119547"
kind: "vulnerability"
aliases: ["CVE-2026-119547"]
title: "Forgejo: key lookup lets signed-in users read other users' SSH keys"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["forgejo", "git", "package", "self-hosted"]
not_affected_if: ["single-user-instance", "version-outside-range"]
published_at: "2026-10-30T12:16:40+00:00"
first_seen_at: "2026-10-30T12:30:26+00:00"
updated_at: "2026-10-30T12:32:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119547", "first_seen_at": "2026-10-30T12:30:26+00:00"}]
---

# Forgejo: key lookup lets signed-in users read other users' SSH keys

Forgejo's GetPublicKey API handler skips an ownership check on key lookups, so any authenticated user can enumerate sequential key IDs. An attacker gets titles, fingerprints and public key material for other users' SSH, deploy and principal keys.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Forgejo version with `forgejo --version` or the server's admin dashboard.
- Confirm whether the instance is on a version in the affected ranges: `15.0.11` and earlier, `16.0.0` through `16.0.7`, or `17.0.0` through `17.0.1`.

## Fix

- Forgejo 15.x: unknown (sources give no fixed version in this range)
- Forgejo 16.x: unknown (sources give no fixed version in this range)
- Forgejo 17.x: unknown (sources give no fixed version in this range)

## Timeline

- 2026-10-30T12:30:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119547

## From the sources

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_