CVE-2026-118394

Full vulnerability record from the local CVENow database.

Description

The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Deferred

Source identifier

88ee5874-cf24-4952-aea0-31affedb7ff2

Published

2026-11-01 10:18:36.227000

Last modified

2026-11-01 10:18:36.330000

View original CVE JSON

{
  "id": "CVE-2026-118394",
  "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2",
  "published": "2026-11-01T10:18:36.227",
  "lastModified": "2026-11-01T10:18:36.330",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token."
    }
  ],
  "affected": [
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "affectedData": [
        {
          "vendor": "Gitea",
          "product": "Gitea",
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "versions": [
            {
              "version": "1.23.0",
              "lessThan": "28.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://blog.gitea.com/release-of-28.3.0/",
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    },
    {
      "url": "https://github.com/go-gitea/gitea/pull/39690",
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    },
    {
      "url": "https://github.com/go-gitea/gitea/pull/39853",
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    },
    {
      "url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0",
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    },
    {
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-q9gm-9c7q-c5hq",
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    }
  ]
}