CVE-2026-119547mediumCWE-639

CVE-2026-119547: medium-severity vulnerability in forgejo

Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}

Published

Follow this CVE+ Monitor Forgejo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
forgejo · forgejo
Related CVEs — forgejo

In the same product, most dangerous first.

CVE-2026-119545MEDIUMForgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID DiscoveryEPSS 0.4%CVE-2026-59102LOWForgejo < 15.0.3 - Stored XSS via Actions Run Full Name RenderingEPSS 0.3%CVE-2026-119546MEDIUMForgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repoEPSS 0.1%