Executive brief
Gitea, a self-hosted Git service, contains a vulnerability where restricted access tokens can bypass security boundaries to view sensitive user information. An attacker with a low-privilege token—intended only for minor tasks—can use a specific identity endpoint to see a user's email address and organizational memberships. While this does not allow access to source code or administrative settings, it results in the unauthorized disclosure of personal identity data.
Technical details
Gitea's OIDC userinfo endpoint (`GET /login/oauth/userinfo`) accepts Gitea API tokens as bearer credentials but fails to validate the assigned scopes before returning identity claims. While standard REST API endpoints correctly enforce scopes (e.g., requiring `read:user` for profile data), this endpoint allows tokens with minimal scopes like `read:misc` to retrieve sensitive claims including `email` and `groups` (organization/team memberships). An attacker must possess a valid, albeit restricted, personal access token to exploit this. The vulnerability is addressed in Gitea version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: disclosed: Initial publication by bircni
- 2026-07-21: advisory: GitHub Advisory published
- 2026-07-21: patched: Fix released in version 1.27.0