The OIDC userinfo endpoint in Gitea (GET /login/oauth/userinfo) improperly accepts API tokens without enforcing the token's scope restrictions. While scoped personal access tokens are enforced on user-related REST API endpoints, the OIDC endpoint returns identity claims including email and groups regardless of the token's assigned scopes. This allows tokens scoped only to 'read:misc' to access identity information that should be restricted. The issue weakens the authorization boundary of API token scopes but does not grant access to repositories, issues, or administrative functions.

Attackers with API tokens scoped narrowly (e.g., 'read:misc') can retrieve identity information such as email addresses and organization/team memberships via the OIDC userinfo endpoint. This disclosure does not extend to repository data, issues, pull requests, or administrative capabilities. The impact is limited to unauthorized disclosure of user identity claims, weakening the intended scope-based access control for API tokens.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using API tokens with minimal scopes in contexts where the OIDC userinfo endpoint is accessible or restrict access to this endpoint. Monitor vendor communications for updates on patches addressing this scope enforcement issue.