Read the docs
TI-2026-61636 Aliases CVE-2026-90679GHSA-5cjj-j77f-rq2g

Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing…

Priority LOW 19CWE-348Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belonging to the actor named in the activity body. The signature verification in routers/api/v1/activitypub/reqsignature.go validates the request signature, but the inbox activity handlers subsequently read the acting identity from the attacker-controlled JSON body without binding it to the verified signing key. Additionally, the signed Digest header is not recomputed against the received request body. A remote attacker who hosts a single valid ActivityPub actor and keypair can therefore submit signature-valid activities attributed to any actor identity they name.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00177 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ForgejoForgejo13.0.0 – 16.0.4—No fix listedCNA
  • Forgejo VendorForgejo Affected 13.0.0 – 16.0.4 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-90679
  2. 2026-10-03 Alias added: GHSA-5cjj-j77f-rq2g

References

Other 1

  • TI-2026-83009 Forgejo server-side request forgery via OpenID Discovery CVSS 4.0MEDIUM 6.9
  • TI-2026-83010 Path traversal in Forgejo restore-repo lets attackers read files CVSS 4.0MEDIUM 6.8
  • TI-2026-83011 Forgejo API lets authenticated users read other users' SSH keys CVSS 4.0MEDIUM 5.3
  • TI-2026-60375 Forgejo before 16.0.4 allows remote code execution via a crafted template repository… CVSS 3.1CRITICAL 9.9
  • TI-2026-42282 Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering CVSS 4.0LOW 2.1
  • TI-2025-42393 Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain… CVSS 4.0CRITICAL 9.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences