CVE-2026-55982 in Gitea
Summary
by MITRE • 08/13/2026
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability described in this CVE involves a critical security flaw in OpenID Connect implementations where the userinfo endpoint exposes identity claims without properly validating or enforcing the scopes associated with the API access token. This represents a significant authorization bypass vulnerability that can lead to unauthorized access to sensitive user information and potentially enable privilege escalation attacks.
This technical flaw stems from improper scope validation within the OpenID Connect authentication flow, specifically when the userinfo endpoint processes requests. The vulnerability occurs because the system fails to verify that the access token presented by the client contains the appropriate scopes required to access specific identity claims. This allows attackers to retrieve user information through the userinfo endpoint even when their tokens lack the necessary permissions, effectively bypassing the intended authorization controls. According to CWE-284, this represents an improper access control vulnerability where insufficient scope validation enables unauthorized information disclosure.
The operational impact of this vulnerability is substantial as it can result in information disclosure attacks that compromise user privacy and potentially enable further exploitation. An attacker who gains access to a valid but limited scope token could leverage this flaw to obtain additional user attributes such as email addresses, phone numbers, or other personal information that should only be accessible with elevated permissions. This issue particularly affects systems implementing OAuth 2.0 and OpenID Connect protocols where the userinfo endpoint serves as a critical component for retrieving user identity information. The vulnerability aligns with ATT&CK technique T1566 which involves credential access through exploitation of weak or improperly enforced authorization controls.
Organizations can address this vulnerability by implementing proper scope validation mechanisms within their OpenID Connect implementations. The solution requires ensuring that the userinfo endpoint performs comprehensive checks against the scopes contained in the presented access token before returning any identity claims. This includes validating that the token contains the appropriate scope for accessing specific user attributes and rejecting requests that attempt to access information beyond the granted permissions. Security measures should also include implementing proper logging and monitoring of userinfo endpoint access patterns to detect anomalous behavior that might indicate exploitation attempts. Additionally, regular security testing and code reviews focused on authorization controls can help identify similar vulnerabilities in other components of the authentication infrastructure. The fix must ensure compliance with OAuth 2.0 specifications and OpenID Connect standards that mandate proper scope enforcement for information disclosure endpoints.