Skip to content
OpenAdvisories

Vendor

forgejo

8 known vulnerabilities.

Products

forgejo 8
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-119547

    Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}

    Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can …

    forgejo forgejo
  • Medium 5.5
    CVE-2026-119546

    Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo

    Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release…

    forgejo forgejo
  • Medium 5.3
    CVE-2026-119545

    Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery

    Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers ca…

    forgejo forgejo
  • Medium 4.3
    CVE-2026-90679

    Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity in…

    forgejo forgejo
  • Medium 5.4
    CVE-2026-59102

    Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering

    Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by setting a full name containing an HTML payload and triggering an Actions run. When the D…

    forgejo forgejo