CVE-2026-119547
Medium · 4.3CVSS
4.3
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63401 Coop is an open source review and moderation tool from ROOST. CWE-639
- CVE-2026-63338 IXP Manager is a full-stack web application for managing Internet Exchange Points. CWE-639
- CVE-2026-62277 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage… CWE-639
- CVE-2026-62991 Shopper is a Headless e-commerce Admin Panel. CWE-639
- CVE-2026-119329 Immich is a high-performance self-hosted photo and video management solution. CWE-639
- CVE-2026-116239 In server mode pgAdmin 4 keeps an account per authentication source, so the same username… CWE-639
- CVE-2026-120007 NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows… CWE-639
- CVE-2026-107868 Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0… CWE-639