Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119547Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in forgejo from forgejo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 83.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.

Affected products (as reported)

Vendor	Product	Versions
forgejo	forgejo	0 – through 15.0.1116.0.0 – through 16.0.717.0.0 – through 17.0.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/routers/api/v1/user/key.go#L191 technical-description
https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/models/asymkey/ssh_key.go#L139-L143 technical-description
https://abraxaslabs.tech/research/forgejo-keys-idor third-party-advisory
https://codeberg.org/forgejo/forgejo product
VulnCheck Advisory: Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id} third-party-advisory