CVE-2026-55982 — OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Affected: Gitea Open Source Git Server

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

GHSA-mg4f-x9v4-6h2p — Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Affected: Go: code.gitea.io/gitea

### Summary

The OIDC userinfo endpoint (`GET /login/oauth/userinfo`) accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims.

A personal access token scoped only to `read:misc` can successfully retrieve user information from the OIDC userinfo endpoint, even though the same token is denied access to user-related REST API endpoints that enforce scope checks.

As a result, identity information remains accessible through the OIDC endpoint regardless of the scopes assigned to the API token.

### Details

Gitea supports scoped personal access tokens and enforces scope checks on user-related REST API endpoints.

For example, a token scoped only to `read:misc` is denied access to endpoints such as:

| Endpoint | Required Scope | |----------|----------------| | `GET /api/v1/user` | `read:user` | | `GET /api/v1/user/emails` | `read:user` | | `GET /api/v1/user/orgs` | `read:organization` |

Requests to these endpoints return:

```http 403 Forbidden ```

with a scope-related error.

However, the same `read:misc` token can be supplied as a bearer credential to:

```http GET /login/oauth/userinfo Authorization: Bearer <token> ```

and receives a successful response containing identity claims.

Observed claims include:

- `email` - `groups`

The `groups` claim contains organization and team membership information associated with the authenticated user.

This behavior indicates that the OIDC userinfo endpoint accepts API tokens…

Most recent entries from all

CVE-2026-55982 — OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

GHSA-mg4f-x9v4-6h2p — Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes