CVE-2026-119547

A flaw was found in Forgejo. The GetPublicKey Application Programming Interface API handler does not enforce ownership checks during key lookups. An authenticated remote attacker with read access can exploit this flaw by enumerating sequential key identifiers, resulting in information disclosure ...