Skip to main content

Forgejo CVE-2023-49946

CRITICAL
Incorrect Permission Assignment for Critical Resource (CWE-732)
2023-12-03 cve@mitre.org
Authentication Bypass Forgejo
9.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Dec 03, 2023 - 19:15 nvd
CRITICAL 9.1

DescriptionNVD

In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions.

AnalysisAI

In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions. Affected products include: Forgejo. Version information: before 1.20.5.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and restrict file/resource permissions, apply principle of least privilege.

More in Forgejo

View all
CVE-2026-89094 CRITICAL
9.9 Sep 10

Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run

CVE-2023-49947 HIGH
7.5 Dec 03

Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. Rated high severity (CVSS 7.5), t
CVE-2026-82556 LOW POC
2.1 Aug 30

Server-side request forgery in Forgejo up to 15.0.4 allows authenticated users to bypass the repository migration IP all
CVE-2026-59102 LOW POC
2.1 Jul 02

Stored XSS in Forgejo before 15.0.3 allows authenticated users to execute arbitrary JavaScript in other users' browsers

CVE-2023-49948 MEDIUM
5.3 Dec 03

Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or
CVE-2026-90679 MEDIUM
4.3 Sep 13

Identity spoofing in Forgejo's ActivityPub federation allows a remote attacker who controls any single valid ActivityPub
CVE-2026-89151 LOW
3.5 Sep 11

Restricted API token authorization bypass in Forgejo before 16.0.4 (and before 15.0.8 on the 15.x branch) allows authent

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all
CVE-2017-9462 HIGH POC
8.8
CVE-2017-3006 HIGH POC
8.8
CVE-2017-9602 CRITICAL POC
9.8
CVE-2022-22960 HIGH POC
7.8
CVE-2021-38085 HIGH POC
7.8
CVE-2021-35449 HIGH POC
7.8
CVE-2020-11855 HIGH POC
7.8
CVE-2020-10883 HIGH POC
7.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2023-49946 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy