Threats affecting pkg:github/forgejo/forgejo

Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belonging to the actor named in the activity body. The signature verification in routers/api/v1/activitypub/reqsignature.go validates the request signature, but the inbox activity handlers subsequently read the acting identity from the attacker-controlled JSON body without binding it to the verified signing key. Additionally, the signed Digest header is not recomputed against the received request body. A remote attacker who hosts a single valid ActivityPub actor and keypair can therefore submit signature-valid activities attributed to any actor identity they name.

Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by setting a full name containing an HTML payload and triggering an Actions run. When the DEFAULT_SHOW_FULL_NAME option is enabled, the run description is assembled server-side with the user's display name interpolated into an HTML string via a translation function that does not escape its arguments, and the frontend renders the result using a Vue v-html binding, causing script execution for any user who views the affected Actions run page.

CVE-2025-68971 is a medium-severity denial of service (DoS) vulnerability in Forgejo versions up to 13.0.3. The issue arises from the attachment component, which allows an attacker with limited privileges to upload extremely large multi-gigabyte files associated with issues or releases. This can exhaust system resources, leading to service disruption. Exploitation does not require user interaction but does require some level of privileges. No known exploits are currently reported in the wild. The vulnerability impacts availability but does not affect confidentiality or integrity. Organizations using Forgejo should monitor for updates and implement controls to restrict attachment sizes to mitigate risk. The threat primarily affects organizations relying on Forgejo for source code management and issue tracking, especially those with exposed or shared upload capabilities.