CVE-2023-49946

In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions.

• CWE-732

• https://about.gitea.com/securityNot Applicable
• https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.mdRelease Notes, Vendor Advisory
• https://forgejo.org/2023-11-release-v1-20-5-1/Release Notes, Vendor Advisory
• https://github.com/gogs/gogs/securityNot Applicable
• https://about.gitea.com/securityNot Applicable
• https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.mdRelease Notes, Vendor Advisory
• https://forgejo.org/2023-11-release-v1-20-5-1/Release Notes, Vendor Advisory
• https://github.com/gogs/gogs/securityNot Applicable

Published

Dec 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49936An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, a…7.5
• CVE-2023-49937An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, a…9.8
• CVE-2023-49938An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x…8.2
• CVE-2023-4994The Allow PHP in Posts and Pages plugin for WordPress is vul…6.4
• CVE-2023-49943Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows s…5.4
• CVE-2023-49944The Challenge Response feature of BeyondTrust Privilege Mana…6.7
• CVE-2023-49947Forgejo before 1.20.5-1 allows 2FA bypass when docker login …7.5
• CVE-2023-49948Forgejo before 1.20.5-1 allows remote attackers to test for …5.3
• CVE-2023-49949Passwork before 6.2.0 allows remote authenticated users to b…8.1
• CVE-2023-4995The Embed Calendly plugin for WordPress is vulnerable to Sto…5.4
• CVE-2023-49950The Jinja templating in Logpoint SIEM 6.10.0 through 7.x bef…5.4
• CVE-2023-49952Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a…7.5