Ybsun0215

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** The OIDC userinfo endpoint `GET /login/oauth/userinfo` accepts Gitea API tokens as bearer credentials but fails to enforce API token scopes before returning identity claims. This allows a token with limited permissions, such as `read:misc`, to retrieve sensitive identity information including `email` and `groups` (organization and team membership), even when the same token is correctly denied access to user-related REST API endpoints like `GET /api/v1/user`, `GET /api/v1/user/emails`, and `GET /api/v1/user/orgs` due to missing `read:user` or `read:organization` scopes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** A user who previously had access to a private repository can continue to obtain repository metadata after their access has been revoked. While direct access to the repository is correctly denied, the repository may still appear in the user's starred or subscription lists, allowing the retrieval of metadata such as the repository name (`full name`), description, and visibility status (`private`). This information remains current, as changes made to the metadata after access revocation are reflected in subsequent responses. This issue affects the following authenticated endpoints: - 'GET /api/v1/user/starred' - 'GET /api/v1/user/subscriptions' **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea version 1.26.2 **Description** Fork synchronization continues even after a parent repository is changed from public to private. This behavior allows a fork to maintain access and synchronize data from a repository that should no longer be authorized for such access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea version 1.26.2 **Description** Unauthorized users can access labels associated with private organizations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Notification API (affected versions not specified) **Description** The Notification API leaks private issue metadata after access has been revoked. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.