CVE-2026-55982
CRITICAL
CVSS 9.1
code.gitea.io/gitea
Verified Advisory
OIDC userinfo scope bypass in Gitea (CVE-2026-55982)
The OIDC userinfo endpoint (`GET /login/oauth/userinfo`) in Gitea accepts personal access tokens as bearer credentials without enforcing their assigned scopes. A token scoped only to `read:misc` - which is denied access to user-related REST API endpoints - can successfully retrieve identity claims including email address and organization/team membership (`groups`) from this endpoint. This weakens the authorization boundary established by API token scopes, exposing identity information to holders of narrowly scoped tokens.
Affected versions:
- 1.26.2
We recommend updating to: 1.27.0.
CVSS 9.1 · our assessment: act_now
Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-mg4f-x9v4-6h2p
Details: https://vuln.today/cve/CVE-2026-55982
Verified by vuln.today against published advisories.
Affected versions
- – 1.26.2
Fixed in: 1.27.0
More advisories for code.gitea.io/gitea
- CVE-2026-20706 – Token scope bypass on archive download endpoint in Gitea (CVE-2026-20706)
- CVE-2026-58314 – Server-side request forgery in Gitea hostmatcher and OpenID sign-in (CVE-2026-58314)
- CVE-2026-58436 – Quadratic-time denial of service in Gitea Locale middleware (CVE-2026-58436)
- CVE-2026-58437 – Repository visibility manipulation via undocumented git push options in Gitea (CVE-2026-58437)
- CVE-2026-55987 – Account deactivation bypass via OAuth2 sign-in in Gitea (CVE-2026-55987)
- CVE-2026-54481 – Improper certificate validation in Gitea internal API HTTP client (CVE-2026-54481)
- CVE-2026-58443 – Authorization bypass in Gitea pull request update API endpoint (CVE-2026-58443)
- CVE-2026-56654 – Privilege escalation via Personal Access Token scope bypass in Gitea (CVE-2026-56654)