The vulnerability allows clients to request introspection of an OAuth token and receive metadata for tokens associated with other clients. This violates the restrictions defined in RFC 7662 section 4 and results in unintended disclosure of token usage information. Attackers could learn which other services are authenticated, what scopes are granted, and other sensitive details that could aid in future attacks. The weakness aligns with CWE‑200 (Information Exposure) and CWE‑863 (Authorization Bypass Through User‑Controlled Key).

This flaw exists in Gitea’s open‑source Git server component. Any installation of Gitea that has not yet applied the fix found in the 1.27.0 release is vulnerable. Versions preceding 1.27.0 are potentially affected.

Exploitability depends on exposure of the token introspection endpoint. If the endpoint is accessible over a network, any authenticated client can obtain the metadata of arbitrary tokens. The risk is information disclosure; no direct code execution is possible. Because no EPSS score is available and the vulnerability is not listed in KEV, a quantitative likelihood is unknown. The mitigation priority remains high because the exposed data can support social engineering, credential reuse, or further attacks against other services. The likely attack vector is an authenticated request to the introspection endpoint; this inference is based on the description.