CVE-2026-90679 Forgejo CVE debrief

Who should care

Defenders responsible for Forgejo instances, especially those with federation enabled, should assess exposure and implement compensating controls to mitigate potential identity spoofing risks.

Why it matters

CVE-2026-90679 is a medium-severity vulnerability affecting Forgejo, allowing an attacker to spoof the identity of any actor in an ActivityPub activity. Defenders should prioritize verifying affected versions, assessing exposure, and implementing compensating controls to mitigate potential identity spoofing risks.

• Defenders need to verify affected versions and assess exposure to potential identity spoofing risks.
• Compensating controls should be implemented to detect and prevent potential identity spoofing attempts.
• Monitoring for suspicious activity is necessary to identify potential exploitation attempts.

Technical summary

The vulnerability occurs when federation is enabled in Forgejo. An attacker can submit signature-valid activities attributed to any actor identity they name without verifying the HTTP signature was produced by the claimed actor's key. This issue impacts identity integrity but does not allow account takeover or content modification. A remote attacker who hosts a single valid ActivityPub actor and keypair can therefore submit signature-valid activities attributed to any actor identity they name. Defenders should prioritize verifying affected versions, assessing exposure, and implementing compensating controls to mitigate potential identity spoofing risks.

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and implementing compensating controls to mitigate potential identity spoofing risks.

Recommended defensive actions

• Verify if the system uses Forgejo and assess exposure by checking the federation configuration and version.
• Implement compensating controls to detect and prevent potential identity spoofing attempts.
• Monitor for suspicious activity and update to a non-affected version if possible.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE description and NVD detail page provide information on the vulnerability, its impact, and affected versions. However, additional verification is required to determine the full scope of affected systems and potential consequences.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.