Vulnerability Description
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://abraxaslabs.tech/research/forgejo-keys-idor
- https://codeberg.org/forgejo/forgejo
- https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/models/asymkey/ssh_key.go#L
- https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/routers/api/v1/user/key.go#
- https://www.vulncheck.com/advisories/forgejo-through-15.0.11-16.0.7-and-17.0.1-i
FAQ
What is CVE-2026-119547?
CVE-2026-119547 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups....
How severe is CVE-2026-119547?
CVE-2026-119547 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119547?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.