CVE-2026-90679 Details

A spoofing vulnerability has been identified in Forgejo versions 13.0.0 through 16.0.4, when federation is enabled. The issue arises because the application does not properly verify that the HTTP Signature of incoming ActivityPub activities was generated by the key of the actor mentioned in the activity body. Although the signature verification process correctly validates the request signature, the inbox activity handlers later read the acting identity from the JSON body, which can be controlled by an attacker, without ensuring it corresponds to the verified signing key. Additionally, the signed Digest header is not recalculated based on the received request body. As a result, a remote attacker with a valid ActivityPub actor and keypair can send signature-valid activities attributed to any actor they choose, potentially impersonating local users and manipulating their social interactions, such as following or unfollowing users and starring repositories, including private ones.

Forgejo has acknowledged this vulnerability and implemented a fix in a recent pull request. Users should update to the latest version where this fix is applied.