OAuth2 Userinfo Endpoint Vulnerability in Gitea by Go-Gitea

CVE-2026-118394

What is CVE-2026-118394?

The OAuth2 userinfo endpoint in Gitea has a vulnerability where it improperly limits the groups claim by re-parsing the Authorization header as an access token. This flaw allows an unauthorized disclosure of the token owner's private organizations and concealed memberships when public-only OAuth2 tokens are misused. To mitigate this issue, the endpoint has been updated to accurately apply the scope of the authenticating token, ensuring that sensitive data remains protected and only accessible to authorized users.

References