TI-2023-27308 Aliases CVE-2023-49946 GHSA-fv68-mgcx-47jh

In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a…

MEDIUM 41CWE-732Published 2023-12-03 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions.

Why it matters now

EPSS 0.0086 58th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:forgejo:forgejo::::::::	before 1.20.5-1	Vulnerable	Forgejo

cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:* Versions before 1.20.5-1 Vulnerable ·Forgejo

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-49946
2026-10-03 Alias added: GHSA-fv68-mgcx-47jh

References

Advisory 2

Other 2

TI-2023-27309 Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. CVSS 3.1HIGH 7.5
TI-2023-27310 Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences