CVE-2026-118394 json
Gitea OAuth2 userinfo private group disclosure to public-only tokens
published 8d ago modified 3d ago also EUVD-2026-114802
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 9%
- public exploits
- 0
- none known
Summary
The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token.
Patch / fix
- Gitea Gitea 28.3.0
- github.com/go-gitea/gitea#39690 pull request
- github.com/go-gitea/gitea#39853 pull request
- github.com/go-gitea/gitea/releases/tag/v28.3.0 release
Is CVE-2026-118394 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3d ago
Exploit prediction
0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected products
- Gitea Gitea
Classification
References
-
github.com
/go-gitea/gitea/pull/39690
patch
-
github.com
/go-gitea/gitea/pull/39853
patch
-
github.com
/go-gitea/gitea/security/advisories/GHSA-q9gm-9c7q-c5hq
vendor-advisory
-
blog.gitea.com
/release-of-28.3.0/
release-notes
-
github.com
/go-gitea/gitea/releases/tag/v28.3.0
release-notes
Sources
- CVE List CVE-2026-118394
- NVD CVE-2026-118394
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.