---
id: CVE-2026-119547
title: >-
  Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via
  /api/v1/user/keys/{id}
summary: >-
  Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1
  contains an information disclosure vulnerability in the GetPublicKey API
  handler that lacks an ownership check on key lookups. Authenticated users with
  a read:user…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: forgejo
product: forgejo
affected:
  - forgejo <= 15.0.11
  - forgejo >= 16.0.0 <= 16.0.7
  - forgejo >= 17.0.0 <= 17.0.1
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:19:47.076699Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:20:15.874Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119547'
references:
  - url: >-
      https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/routers/api/v1/user/key.go#L191
  - url: >-
      https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/models/asymkey/ssh_key.go#L139-L143
  - url: 'https://abraxaslabs.tech/research/forgejo-keys-idor'
  - url: 'https://codeberg.org/forgejo/forgejo'
  - url: >-
      https://www.vulncheck.com/advisories/forgejo-through-15.0.11-16.0.7-and-17.0.1-information-disclosure-via-api-v1-user-keys-id
    label: >-
      VulnCheck Advisory: Forgejo through 15.0.11, 16.0.7, and 17.0.1
      Information Disclosure via /api/v1/user/keys/{id}
tags:
  - cve.org
  - exploit-available
epss: 0.00251
epssPercentile: 0.16561
ingestedAt: '2026-11-03T11:43:15.773Z'
---

## Overview

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.

## Affected

- `forgejo <= 15.0.11`
- `forgejo >= 16.0.0 <= 16.0.7`
- `forgejo >= 17.0.0 <= 17.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.