{"api_version":"1","generated_at":"2026-11-02T19:50:34+00:00","cve":"CVE-2026-118394","urls":{"html":"https://cve.report/CVE-2026-118394","api":"https://cve.report/api/cve/CVE-2026-118394.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-118394","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-118394"},"summary":{"title":"Gitea OAuth2 userinfo private group disclosure to public-only tokens","description":"The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token.","state":"PUBLISHED","assigner":"Gitea","published_at":"2026-11-01 10:18:36","updated_at":"2026-11-01 10:18:36"},"problem_types":["CWE-200","CWE-863","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","CWE-863 CWE-863: Incorrect Authorization"],"metrics":[],"references":[{"url":"https://github.com/go-gitea/gitea/pull/39690","name":"https://github.com/go-gitea/gitea/pull/39690","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://blog.gitea.com/release-of-28.3.0/","name":"https://blog.gitea.com/release-of-28.3.0/","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/39853","name":"https://github.com/go-gitea/gitea/pull/39853","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q9gm-9c7q-c5hq","name":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q9gm-9c7q-c5hq","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","name":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-118394","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118394","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Gitea","product":"Gitea","version":"affected 1.23.0 28.3.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"https://github.com/N0K0","lang":"en"},{"source":"CNA","value":"https://github.com/lunny","lang":"en"},{"source":"CNA","value":"https://github.com/silverwind","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"118394","cve":"CVE-2026-118394","epss":"0.001980000","percentile":"0.096040000","score_date":"2026-11-01","updated_at":"2026-11-02 00:05:52"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"gitea.dev","product":"Gitea","vendor":"Gitea","versions":[{"lessThan":"28.3.0","status":"affected","version":"1.23.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"https://github.com/N0K0"},{"lang":"en","type":"analyst","value":"https://github.com/lunny"},{"lang":"en","type":"remediation developer","value":"https://github.com/silverwind"}],"descriptions":[{"lang":"en","value":"The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"},{"cweId":"CWE-863","description":"CWE-863: Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-01T09:48:49.431Z","orgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","shortName":"Gitea"},"references":[{"name":"GitHub Security Advisory GHSA-q9gm-9c7q-c5hq","tags":["vendor-advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q9gm-9c7q-c5hq"},{"name":"Fix: go-gitea/gitea pull request #39690","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39690"},{"name":"Fix backport to release/v28: go-gitea/gitea pull request #39853","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39853"},{"name":"Gitea 28.3.0 release announcement","tags":["release-notes"],"url":"https://blog.gitea.com/release-of-28.3.0/"},{"name":"go-gitea/gitea v28.3.0 release","tags":["release-notes"],"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0"}],"title":"Gitea OAuth2 userinfo private group disclosure to public-only tokens"}},"cveMetadata":{"assignerOrgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","assignerShortName":"Gitea","cveId":"CVE-2026-118394","datePublished":"2026-11-01T09:48:49.431Z","dateReserved":"2026-11-01T08:48:41.165Z","dateUpdated":"2026-11-01T09:48:49.431Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-01 10:18:36","lastModifiedDate":"2026-11-01 10:18:36","problem_types":["CWE-200","CWE-863","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","CWE-863 CWE-863: Incorrect Authorization"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"118394","Ordinal":"1","Title":"Gitea OAuth2 userinfo private group disclosure to public-only to","CVE":"CVE-2026-118394","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"118394","Ordinal":"1","NoteData":"The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token.","Type":"Description","Title":"Gitea OAuth2 userinfo private group disclosure to public-only to"}]}}}