Is CVE-2026-118394 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118394 being exploited in the wild.

How severe is CVE-2026-118394?

Informational severity, published 1 November 2026.

Is there a fix for CVE-2026-118394?

Yes: fixed in Gitea 28.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118394 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-118394?

Check whether you run Gitea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118394: Gitea OAuth2 userinfo endpoint private group disclosure

CVE-2026-118394 · Severity: info · Published 2026-11-01

Gitea's OAuth2 userinfo endpoint had a flaw in how it determined which groups to return to a caller. When a limited-scope token was sent as a URL parameter rather than an HTTP header, the endpoint failed to properly restrict groups, exposing a user's private organization memberships, team names, and concealed memberships to unauthorized callers. This could allow an attacker to discover hidden organizational structure that should not be visible to their access level.

Technologies: Gitea. Vendors: Gitea.

Quick answers

Is CVE-2026-118394 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118394 being exploited in the wild.
How severe is CVE-2026-118394?: Informational severity, published 1 November 2026.
Which products and versions are affected?: Gitea before 28.3.0.
Is there a fix for CVE-2026-118394?: Yes: fixed in Gitea 28.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118394 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-118394?: Check whether you run Gitea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Gitea 28.3.0

Technical details

The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) parsed the `Authorization` header as an OAuth2 access token to determine scope, ignoring when the actual authenticating credential was sent as a query parameter or form field. When a public-only token arrived via URL parameter, the scope check came back empty and the endpoint returned the full groups list including private organizations and teams. The fix ensures the endpoint uses the scope of the credential that actually authenticated the request, regardless of transmission method.

Affected products

Gitea Gitea before 28.3.0

Timeline

2026-11-01: disclosed
2026-11-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.