Executive brief
Forgejo is a self-hosted Git service that supports federated communication with other platforms through ActivityPub. When federation is enabled, attackers can forge activities (such as follows, unfollows, or repository stars) attributed to any identity by hosting a single valid keypair and signing requests with their own key while claiming a different sender in the activity body. This undermines trust in user identities and social relationships but does not enable account takeover or content modification.
Technical details
The vulnerability is an HTTP Signature verification bypass in the ActivityPub inbox handlers (routers/api/v1/activitypub/reqsignature.go). The code validates that an incoming request carries a valid HTTP Signature, but then reads the acting identity directly from the attacker-controlled JSON activity body without binding it to the verified signing key. Additionally, the signed Digest header is never recomputed against the received request body, allowing digest tampering. An attacker with one valid actor keypair can submit activities attributed to any identity, including shadowing local users, creating fake identities, forging follow/unfollow relationships, and starring repositories. The fix requires binding the keyId owner to the activity's actor field and recomputing the Digest header. Federation must be explicitly enabled in configuration; it is disabled by default.
Affected products
- Forgejo Forgejo 13.0.0 through 16.0.4
Timeline
- 2026-09-07: disclosed: Security issue reported to Forgejo project
- 2026-09-13: advisory: CVE-2026-90679 published