CVE-2026-118394

The Gitea OAuth2 userinfo endpoint (/login/oauth/userinfo) is vulnerable to private group disclosure due to incorrect authorization logic. The system incorrectly re-parsed the Authorization header as an OAuth2 access token instead of using the scope of the authenticating credential. Consequently,...