CVE-2023-49948: Forgejo

Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.

Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL.

Affected products

• Forgejo Forgejo: before 1.20.5-1 (fixed in 1.20.5-1)

Published 2023-12-03. Last modified 2026-06-17.