Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90679

Quick assessment

Affected
Forgejo Forgejo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Forgejo是Forgejo组织开源的一款源代码管理平台。 Forgejo 13.0.0版本至16.0.4版本存在信任管理问题漏洞，该漏洞源于未验证传入ActivityPub活动的HTTP签名是否由活动正文中指定行为者的密钥生成，且未对签名的Digest标头与接收请求正文重新计算，可能导致远程攻击者提交归因于任意行为者身份的签名有效活动，造成身份完整性受损。

CVSS 4.3 · Medium EPSS 0.16% · P6

Possible ATT&CK Techniques 1 AI

T1598.004 · Spearphishing Voice

Affected Version Matrix 1

VendorProduct Version RangeStatus
Forgejo Forgejo 13.0.0≤ 16.0.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90679

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belonging to the actor named in the activity body. The signature verification in routers/api/v1/activitypub/reqsignature.go validates the request signature, but the inbox activity handlers subsequently read the acting identity from the attacker-controlled JSON body without binding it to the verified signing key. Additionally, the signed Digest header is not recomputed against the received request body. A remote attacker who hosts a single valid ActivityPub actor and keypair can therefore submit signature-valid activities attributed to any actor identity they name.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用不可信的源
Source: CVE Program / CVE List V5
Vulnerability Title
Forgejo 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Forgejo是Forgejo组织开源的一款源代码管理平台。 Forgejo 13.0.0版本至16.0.4版本存在信任管理问题漏洞，该漏洞源于未验证传入ActivityPub活动的HTTP签名是否由活动正文中指定行为者的密钥生成，且未对签名的Digest标头与接收请求正文重新计算，可能导致远程攻击者提交归因于任意行为者身份的签名有效活动，造成身份完整性受损。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Forgejo Forgejo 13.0.0 ~ 16.0.4 -

II. Public POCs for CVE-2026-90679

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90679

请登录查看更多情报信息。

Other References for CVE-2026-90679 (1)

IV. Related Vulnerabilities

Same product: Forgejo
Same vendor: Forgejo
Same weakness: CWE-348

V. Comments for CVE-2026-90679

No comments yet

Leave a comment