OIDC Userinfo Endpoint Exposes Identity Claims Without Token Scope Enforcement

Executive Summary

This vulnerability affects Gitea versions up to 1.26.2. The OIDC userinfo endpoint (GET /login/oauth/userinfo) accepts Gitea API tokens as bearer credentials but fails to enforce API token scopes before returning identity claims. This allows a token with limited scopes, like read:misc, to retrieve sensitive user information such as email and group memberships.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a version up to 1.26.2. Use commands like 'gitea --version' or inspect the version in the web interface under Site Administration. Verify if the OIDC userinfo endpoint (GET /login/oauth/userinfo) accepts API tokens without scope enforcement by testing with a token scoped to read:misc and checking if it returns identity claims.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows unauthorized disclosure of identity information tied to the authenticated user. While it does not grant access to repositories, issues, or administrative functions, it weakens scope-based authorization controls, potentially exposing personal data like email and group memberships.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later immediately to patch the vulnerability. If upgrading is not possible, restrict access to the OIDC userinfo endpoint or disable OIDC functionality until the update is applied. Monitor logs for unauthorized access attempts to this endpoint.

Useful 0 Not Useful 0