Information Disclosure Vulnerability in Forgejo API

CVE-2026-119547

What is CVE-2026-119547?

Forgejo versions up to 17.0.1 exhibit a serious security issue within the GetPublicKey API handler, where an ownership verification check is missing during key lookups. This flaw allows authenticated users with specific tokens or session credentials to enumerate key identifiers. By exploiting this vulnerability, such users can gain unauthorized access to sensitive information, including the titles, fingerprints, and public key material linked to others' SSH, deploy, and principal keys. This potentially exposes critical user assets to malicious actors.

References