dbcve.org
Cross-site Scripting (XSS)Weakness · CWE-79

CVE-2026-59102

MEDIUM · 5.4 CVSS v3.1 Published 2026-07-02
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
58/100
Remediation priority · Elevated
Remotely reachable 7 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by setting a full name containing an HTML payload and triggering an Actions run. When the DEFAULT_SHOW_FULL_NAME option is enabled, the run description is assembled server-side with the user's display name interpolated into an HTML string via a translation function that does not escape its arguments, and the frontend renders the result using a Vue v-html binding, causing script execution for any user who views the affected Actions run page.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Forgejo before 15.0.3 has a stored XSS vulnerability in the Actions feature. An authenticated user can inject malicious JavaScript via their display name when the DEFAULT_SHOW_FULL_NAME option is enabled. The translation function used to interpolate the user's full name into HTML for Action run descriptions does not escape arguments, and the frontend renders this via Vue v-html, allowing arbitrary script execution in other users' browsers.

MitigationUpgrade to Forgejo 15.0.3 or later, or disable the DEFAULT_SHOW_FULL_NAME configuration option if upgrading is not immediately feasible.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Forgejo version
    Check the installed version via the admin dashboard (Site Overview page), the API endpoint /api/v1/version, or the app.ini configuration file.
    Affected if The installed version is before 15.0.3 (e.g., 15.0.2, 15.0.1, 14.x, etc.)
  2. Locate the configuration file
    Find the Forgejo app.ini configuration file, typically located in /etc/forgejo/app.ini or the custom path configured during installation.
    Affected if The configuration file exists and is accessible for inspection.
  3. Check DEFAULT_SHOW_FULL_NAME setting
    Search for 'DEFAULT_SHOW_FULL_NAME' in the app.ini file or view it in the admin panel under Site Settings > Authorization Restrictions.
    Affected if DEFAULT_SHOW_FULL_NAME is set to true or enabled (the vulnerability only applies when this option is on).
  4. Verify Actions feature is in use
    Check if the Actions feature is enabled in the repository or organization settings, or attempt to access the Actions tab on any repository.
    Affected if Actions feature is enabled and users have created or run actions workflows in any repository.
  5. Inspect user display names for injection attempts
    Review user profiles in the admin panel (Admin Dashboard > Users) and check the 'Full Name' field for any unusual characters, script tags, or HTML content.
    Affected if Any user account has a non-empty Full Name field containing potentially malicious content (this indicates the stored XSS may already be present).

A user is affected if they run a Forgejo version before 15.0.3 with DEFAULT_SHOW_FULL_NAME enabled and the Actions feature in use, allowing other users to inject malicious JavaScript via their display name.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade to Forgejo 15.0.3 or later, or disable the DEFAULT_SHOW_FULL_NAME configuration option if upgrading is not immediately feasible.

Recommended fix High confidence

15.0.3 or later

  1. Upgrade Forgejo to version 15.0.3 or later to resolve the stored XSS vulnerability
  2. After upgrading, verify that the DEFAULT_SHOW_FULL_NAME configuration option is properly handled and no malicious full names are present in the system

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation1.0 h
  • Implementation2.0 h
  • Testing2.0 h
  • Review / QA1.0 h
6.0 hours of engineering $1,040
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,664.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-59102 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-59102 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data