A critical vulnerability in Gitea allows unauthenticated attackers to retrieve sensitive user identity claims by bypassing API token scope enforcement.

This vulnerability involves an improper information disclosure (CWE-200) within the OIDC userinfo endpoint. Unauthenticated attackers can query this endpoint to receive sensitive identity information, as the application fails to validate the necessary API token scopes before serving the requested data.

The ability for an unauthenticated party to extract identity claims poses a significant risk to user privacy and system integrity. With a CVSS score of 9.1, this flaw indicates the potential for mass data exfiltration of user profiles, which could facilitate account takeover attacks or further unauthorized lateral movement within the development environment.

Immediate Action: Update Gitea to version 1.27.0 or later to ensure proper scope validation is enforced on the OIDC userinfo endpoint.

Proactive Monitoring: Review access logs for the OIDC userinfo endpoint to identify unusual spikes in traffic or requests originating from unexpected IP addresses.

Compensating Controls: Implement strict network-level access controls to limit exposure of the Gitea OIDC endpoint to trusted internal networks only, reducing the attack surface for external actors.

Public Exploit Available: Unknown

Given the critical severity of this vulnerability and the ease of exploitation, administrators should prioritize the upgrade to version 1.27.0 immediately. Failure to patch this issue leaves user identity data exposed to unauthorized access, which may have severe downstream security implications for your entire development infrastructure.