Vulnerability · Published Nov 1, 2026 · Assigned by Gitea
CVE-2026-118394Gitea OAuth2 userinfo private group disclosure to public-only tokens
Unrated
In plain English
A information exposure in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token.
Affected products (as reported)
Weakness: CWE-200, CWE-863
References
- GitHub Security Advisory GHSA-q9gm-9c7q-c5hq vendor-advisory
- Fix: go-gitea/gitea pull request #39690 patch
- Fix backport to release/v28: go-gitea/gitea pull request #39853 patch
- Gitea 28.3.0 release announcement release-notes
- go-gitea/gitea v28.3.0 release release-notes