CVE-2026-118394None▾ SunlitThe OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential th…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
The OAuth2 userinfo endpoint (/login/oauth/userinfo) decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token.
gitea.dev >= 1.23.0 < 28.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119441NoneGitea public-only token bypass on bulk organization repository deletion
CVE-2026-117685NoneGitea public-only package token access to private OCI blobs
CVE-2026-114199NoneGitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289NoneGitea public-only token bypass through Actions runner registration
CVE-2026-119627NoneGitea limited-visibility profile disclosure with public-only tokens
CVE-2026-119625NoneGitea user and organization feed token scope bypass