CVE-2026-118394 | Gitea up to 28.2.x OAuth2 Userinfo Endpoint /login/oauth/userinfo improper authorization

November 1, 2026 Yanac

A vulnerability classified as problematic was found in Gitea up to 28.2.x. Impacted is an unknown function of the file /login/oauth/userinfo of the component OAuth2 Userinfo Endpoint. Such manipulation leads to improper authorization.

This vulnerability is uniquely identified as CVE-2026-118394. The attack can be launched remotely. No exploit exists.

Upgrading the affected component is advised.VulDB Recent EntriesRead More