Skip to content

CVE record · 1 source

CVE-2026-118394

The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the…

Vendor: Gitea
Product: Gitea
Weakness: CWE-200, CWE-863
Exposure class: Developer platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

20

CVE NVD 4h ago

The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the…

The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the…

CVE-2026-118394 Gitea