CVE-2026-90679
Description
A flaw was found in Forgejo when federation is enabled. This issue allows a remote attacker to spoof identities by submitting signature-valid ActivityPub activities attributed to any actor identity. The system fails to verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belonging to the actor named in the activity body, leading to compromised identity integrity.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To mitigate this issue, disable ActivityPub federation in Forgejo by setting `ENABLED = false` under the `[federation]` section in the Forgejo configuration file. This action will prevent the system from processing incoming ActivityPub activities and may impact features relying on federation. A service restart may be required for the changes to take effect.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
