CVE-2023-49948

Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss or another extension to a URL...

CVE-2023-49948

creationtimestamp| type| source ---|---|--- 2023-12-05 10:06:14+00:00| published-proof-of-concept| https://t.me/WARLOCKDARKARMYOFFICIALS/3644 2023-12-05 10:59:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9524 2023-12-14 06:35:37+00:00| published-proof-of-concept|...

CVE-2023-49948

Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss or another extension to a URL...

CVE-2023-49948

Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss or another extension to a URL...

CVE-2023-49948

Forgejo before 1.20.5-1 is vulnerable to Information Disclosure: an attacker can determine the existence of private user accounts by appending a URL extension such as .rss, due to a lack of appropriate view-permission checks in the UsernameSubRoute/home.go path. The issue affects Forgejo releases...