Is CVE-2026-55982 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55982 being exploited in the wild.

How severe is CVE-2026-55982?

Medium severity, with a CVSS score of 4, published 21 July 2026.

Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Is there a fix for CVE-2026-55982?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55982 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55982?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55982: Gitea OIDC userinfo scope bypass allows identity disclosure

Q: Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Q: Is there a fix for CVE-2026-55982?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55982 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55982?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55982 · Severity: medium · CVSS 4 · Published 2026-07-21

Gitea, a self-hosted Git service, contains a vulnerability where restricted access tokens can bypass security boundaries to view sensitive user information. An attacker with a low-privilege token—intended only for minor tasks—can use a specific identity endpoint to see a user's email address and organizational memberships. While this does not allow access to source code or administrative settings, it results in the unauthorized disclosure of personal identity data.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-55982 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55982 being exploited in the wild.
How severe is CVE-2026-55982?: Medium severity, with a CVSS score of 4, published 21 July 2026.
Which products and versions are affected?: Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-55982?: Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55982 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55982?: Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
```
go get code.gitea.io/gitea@v1.27.0
```
gitea.dev (Go): upgrade to 1.27.0 or later
```
go get gitea.dev@v1.27.0
```

Technical details

Gitea's OIDC userinfo endpoint (`GET /login/oauth/userinfo`) accepts Gitea API tokens as bearer credentials but fails to validate the assigned scopes before returning identity claims. While standard REST API endpoints correctly enforce scopes (e.g., requiring `read:user` for profile data), this endpoint allows tokens with minimal scopes like `read:misc` to retrieve sensitive claims including `email` and `groups` (organization/team memberships). An attacker must possess a valid, albeit restricted, personal access token to exploit this. The vulnerability is addressed in Gitea version 1.27.0.

Affected products

Gitea Gitea < 1.27.0

Identifiers

CVE-2026-55982
GHSA-mg4f-x9v4-6h2p
GO-2026-6065

Timeline

2026-07-13: disclosed: Initial publication by bircni
2026-07-21: advisory: GitHub Advisory published
2026-07-21: patched: Fix released in version 1.27.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.