The flaw lies in the OIDC userinfo endpoint, which does not enforce the scopes that a supplied API token is allowed to access. As a result, an attacker able to present a valid API token can retrieve identity claims that the token was not explicitly granted. This enables unintended leakage of personal or account information tied to the user, potentially revealing e‑mail addresses or other sensitive data without permission. The weakness is a classic information‑exposure issue.

Gitea Open Source Git Server, any instance that has not applied the 1.27.0 release or later and therefore still has the unpatched userinfo endpoint logic. Earlier releases with the same code path are also affected.

The exploitation requires only an authenticated API token that can reach the userinfo endpoint; no additional privileges are needed. The EPSS score is < 1%, but the lack of scope validation makes the vulnerability highly exploitable in environments where API tokens are widely used. The CVSS score of 9.1 indicates a high severity. The issue is not listed in the CISA KEV catalog, but organizations should treat it as a high‑risk information‑disclosure flaw until a patch is applied.