Forgejo CVE-2026-119547

Requires an authenticated account on the target Forgejo instance holding a read:user-scoped API token or an active session (PR:L) - this is the primary limiting factor; exploitation is not possible unauthenticated. Given such access, no further special configuration is needed: the GetPublicKey API handler (routers/api/v1/user/key.go) omits an ownership check on key lookups against default configurations, so an attacker simply enumerates sequential numeric key IDs to read other users' SSH, deploy, and principal key titles, fingerprints, and public key material. Realistic exposure is amplified where self-service registration is enabled (any low-privilege user qualifies) and reduced on closed instances where tokens are tightly controlled. No user interaction is required. Affected: Forgejo through 15.0.11, 16.0.0-16.0.7, and 17.0.0-17.0.1.

This is a genuine but moderate-priority authorization flaw (IDOR / CWE-639), not a high-CVSS-but-low-risk artifact. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) scores 5.3 and is internally consistent with the description: network-reachable API, low attack complexity, and crucially PR:L - the attacker must already hold a valid account or read:user token on the target instance, which meaningfully narrows the threat population versus a PR:N bug. Impact is confined to confidentiality (VC:L; VI:N/VA:N), matching an information-disclosure outcome with no integrity or availability effect. The vuln.today decision label is 'this_month', i.e. prioritized but explicitly not act_now/emergency. No CISA KEV listing and no EPSS score were supplied, so there is no signal of active or widespread exploitation; absence of these is not evidence of safety but should not be read as confirmed exploitation either. A public research reference (abraxaslabs.tech forgejo-keys-idor) and a VulnCheck advisory exist, so the mechanism is publicly documented and the barrier to writing an exploit is low (sequential ID enumeration), but the input does not confirm packaged working exploit code. Net: a real, easily-automatable post-authentication reconnaissance issue worth patching on a normal cycle, not a drop-everything emergency, given the authentication requirement and low-sensitivity data class.

An authenticated low-privilege user on a Forgejo instance (or anyone able to self-register where registration is open) issues their read:user token against the GetPublicKey API endpoint and iterates sequential key IDs. Because the handler performs no ownership check, each request returns another user's key title, fingerprint, and public key material, letting the attacker harvest the full key inventory of every user, deploy key, and principal key on the server. A public research write-up documents the flaw; given AV:N/AC:L the enumeration is trivially scriptable, though a valid account/token (PR:L) is required.