CVE-2026-55982

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but fails to enforce API token scopes before returning identity claims. This allows a token with limited permissions, such as read:misc, to retrieve sensitive identity information including email and groups (organization and team membership), even when the same token is correctly denied access to user-related REST API endpoints like GET /api/v1/user, GET /api/v1/user/emails, and GET /api/v1/user/orgs due to missing read:user or read:organization scopes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.