CVE-2023-49946

2023-12-0300:00:00

mitre

www.cve.org

forgejo

unauthorized access

private data

remote attackers

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.8%

JSON

In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions.