CVE-2026-118394
Deferred Deferred - Pending Action

OAuth2 Userinfo Groups Claim Exposure in GitHub Enterprise Server

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-118394

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 1.23.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Gitea's OAuth2 userinfo endpoint incorrectly handling token scopes when tokens are passed as query parameters or form fields. Instead of using the scope of the authenticating token, it re-parses the Authorization header as an OAuth2 access token, leading to empty scope validation. This causes private organization and team memberships to be exposed in the userinfo response, even when the token is public-only.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a vulnerable version (1.23.0 to 28.2.0). Review logs for requests to the /login/oauth/userinfo endpoint where tokens are passed as query parameters or form fields. Test by sending a public-only token via query parameter and verifying if private organization data is exposed in the response.

Impact Analysis

The vulnerability could expose sensitive information about your private organizations, teams, and concealed memberships. This happens when a public-only OAuth2 token or personal access token is used improperly, such as via query parameters. No repository content is exposed, but organizational data may be leaked.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing sensitive organizational data without proper authorization. Unauthorized disclosure of private team or organization memberships may violate privacy requirements.

Mitigation Strategies

Upgrade Gitea to version 28.3.0 or later to apply the patch. Disable query token authentication by setting DISABLE_QUERY_AUTH_TOKEN=true in your configuration. Review and restrict access to the /login/oauth/userinfo endpoint to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...