Forgejo's GetPublicKey API endpoint lacks an ownership check, allowing authenticated users with a read:user token or session to retrieve the titles, fingerprints, and public key material of any user's SSH, deploy, and principal keys. This information disclosure can aid attackers in social engineering or further compromise by revealing key characteristics that may help in targeted attacks. The vulnerability is characterized as a lack of ownership verification (CWE‑639).

Forgejo servers running versions 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 are impacted. The issue is present in the product "Forgejo" from Abraxas Labs and affects the API route /api/v1/user/keys/{id}. No other vendors or product variants are listed in the CNA data.

The CVSS score of 5.3 indicates moderate severity, but no EPSS score is available, so the likelihood of exploitation cannot be precisely measured. The vulnerability is not currently listed in CISA's KEV catalog. The likely attack vector involves an authenticated user making successive requests to /api/v1/user/keys/{id} with sequential identifiers to enumerate other users' keys; the endpoint returns useful metadata without requiring additional privileges.