Spoofing Vulnerability in Forgejo by Forgejo

CVE-2026-90679

What is CVE-2026-90679?

In Forgejo versions 13.0.0 through 16.0.4, a spoofing vulnerability occurs when '[federation] ENABLED = true'. This flaw compromises identity integrity by not verifying that the HTTP Signature on incoming ActivityPub activities corresponds to the actor's key specified in the activity body. Attackers can exploit this issue by sending valid signature activities attributed to any actor they wish, even though account takeover or direct content modification is not possible. The vulnerability arises from a failure to bind the acting identity from the attacker-controlled JSON body to the verified signing key during signature verification.

References