CVE-2026-90679

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>forgejo15</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is
	set, has a spoofing issue that affects identity integrity but does not
	allow account takeover or content modification. It does not verify
	that the HTTP Signature on an incoming ActivityPub activity was
	produced by the key belonging to the actor named in the activity body.
	The signature verification in
	routers/api/v1/activitypub/reqsignature.go validates the request
	signature, but the inbox activity handlers subsequently read the
	acting identity from the attacker-controlled JSON body without binding
	it to the verified signing key. Additionally, the signed Digest header
	is not recomputed against the received request body. A remote attacker
	who hosts a single valid ActivityPub actor and keypair can therefore
	submit signature-valid activities attributed to any actor identity
	they name.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-90679</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-90679</url>
    </references>
    <dates>
      <discovery>2026-09-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>