MEDIUM 5.3 NVD
CVE-2026-119547
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.
References
- https://abraxaslabs.tech/research/forgejo-keys-idor
- https://codeberg.org/forgejo/forgejo
- https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/models/asymkey/ssh_key.go#L139-L143
- https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/routers/api/v1/user/key.go#L191
- https://www.vulncheck.com/advisories/forgejo-through-15.0.11-16.0.7-and-17.0.1-information
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17475 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.