Forgejo CVE-2026-90679

Exploitation requires that the target Forgejo instance has [federation] ENABLED = true set in its configuration, which is not the default. The attacker must also control or have access to a server running a valid ActivityPub-compatible implementation capable of producing HTTP Signatures - this is the source of the 'low privilege' rating (PR:L). No user interaction on the victim instance is required. Exploitation is constrained to identity spoofing in federated activity attribution only; the CVE description explicitly states that account takeover and modification of repository content are not achievable. Instances without federation enabled are entirely outside the attack surface.

The CVSS 4.3 base score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects limited real-world impact: integrity-only, low severity, no confidentiality or availability consequence. The PR:L metric reflects that the attacker must operate or control a legitimate ActivityPub-compatible server to generate valid HTTP Signatures - a meaningful barrier above zero. No EPSS data is present in the input, no KEV listing exists, and no POC has been identified. Critically, the attack surface is gated by a non-default configuration flag; instances without [federation] ENABLED = true are entirely unaffected, substantially narrowing the real-world exposed population. The vendor-confirmed scope exclusion of account takeover and content modification further limits the operational impact. This is a genuine but low-priority issue - meaningful only on federation-enabled instances where activity attribution integrity matters.

An attacker operates their own Forgejo or ActivityPub-compatible server, establishing a valid actor identity and cryptographic keypair. They craft an ActivityPub JSON activity body naming a victim actor on the target Forgejo instance as the sender, then sign the HTTP request using their own valid keypair. The target Forgejo validates the HTTP Signature successfully (it is cryptographically valid for the attacker's key), but then reads the actor identity from the attacker-supplied JSON body, recording the activity as if it originated from the named victim actor.