EUVD-2026-76944
GHSA-5cjj-j77f-rq2g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attacker must control a valid ActivityPub actor (PR:L); spoofing-only impact yields I:L with no confidentiality or availability consequence.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPubactivity was produced by the key belonging to the actor named in the activity body. The signature verification in routers/api/v1/activitypub/reqsignature.go validates the request signature, but the inbox activity handlers subsequently read the acting identity from the attacker-controlled JSON body without binding it to the verified signing key. Additionally, the signed Digest header is not recomputed against the received request body. A remote attacker who hosts a single valid ActivityPub actor and keypair can therefore submit signature-valid activities attributed to any actor identity they name.
AnalysisAI
Identity spoofing in Forgejo's ActivityPub federation allows a remote attacker who controls any single valid ActivityPub actor and keypair to submit HTTP-Signature-valid activities falsely attributed to arbitrary actor identities on a target instance. Affected versions span 13.0.0 through 16.0.4, but only when federation is explicitly enabled via the non-default setting [federation] ENABLED = true. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Forgejo instance has `[federation] ENABLED = true` set in its configuration, which is not the default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 base score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects limited real-world impact: integrity-only, low severity, no confidentiality or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No confirmed patched release version is present in the available data - the upstream reference points to an issue comment at https://codeberg.org/forgejo/forgejo/issues/14271#issuecomment-22548004 rather than a tagged release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissio
Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. Rated high severity (CVSS 7.5), t
Server-side request forgery in Forgejo up to 15.0.4 allows authenticated users to bypass the repository migration IP all
Stored XSS in Forgejo before 15.0.3 allows authenticated users to execute arbitrary JavaScript in other users' browsers
Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or
Restricted API token authorization bypass in Forgejo before 16.0.4 (and before 15.0.8 on the 15.x branch) allows authent
Same weakness CWE-348 – Use of Less Trusted Source
View allVendor StatusVendor
Debian
Bug #1058932| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Share
External POC / Exploit Code
Leaving vuln.today