CVE-2026-119547
Deferred Deferred - Pending Action

Forgejo Information Disclosure via Unauthorized Key Enumeration

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119547
EUVD
EUVD-2026-113812

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgejo forgejo 0
forgejo forgejo 16.0.0
forgejo forgejo 17.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Forgejo versions through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 have an information disclosure vulnerability in the GetPublicKey API handler. It lacks an ownership check on key lookups, allowing authenticated users with a read:user token or session to enumerate sequential key IDs and access other users' SSH, deploy, and principal keys including titles, fingerprints, and public key material.

Impact Analysis

An attacker with authenticated access could exploit this to steal other users' public keys and related metadata. This could lead to further attacks like impersonation or unauthorized access if those keys are reused elsewhere. The impact is limited to information disclosure and does not allow modification or deletion of data.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by exposing sensitive user information such as public keys and associated metadata. Organizations may face compliance violations, fines, or reputational damage if user data is improperly disclosed due to insufficient access controls.

Mitigation Strategies

Upgrade Forgejo to a version later than 15.0.11, 16.0.7, or 17.0.1 to address the information disclosure vulnerability in the GetPublicKey API handler.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119547. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart