The vulnerability in Gitea's OIDC userinfo endpoint (CVE-2026-55982) arises because the endpoint accepts API tokens as bearer credentials but fails to enforce scope restrictions before returning identity claims. Consequently, a personal access token with only the 'read:misc' scope can access identity information including email addresses and group memberships. This is inconsistent with the scope enforcement on user-related REST API endpoints, resulting in unauthorized disclosure of identity information associated with the authenticated user. The issue affects all Gitea versions prior to 1.27.0.

An attacker or user possessing a personal access token with limited scope ('read:misc') can retrieve sensitive identity claims such as email and group memberships from the OIDC userinfo endpoint. This unauthorized disclosure of identity information can lead to privacy violations and potential further targeting based on exposed user details. The vulnerability does not allow modification or deletion of data, nor does it escalate privileges beyond information disclosure.

A patch is available for this vulnerability in Gitea version 1.27.0 and later. Users should upgrade to version 1.27.0 or newer to ensure scope restrictions are properly enforced on the OIDC userinfo endpoint. No additional mitigations are indicated by the vendor advisory.