{"id":"CVE-2026-118394","kind":"vulnerability","aliases":["CVE-2026-118394"],"related":[],"title":"OAuth2 userinfo endpoint leaks private organization and team memberships to token holders","description":"The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token.","summary":"The OAuth2 userinfo endpoint ignored the scope of the token that authenticated the request when deciding whether to limit the groups claim to public organizations. A public-only token sent as a query parameter or form field, or a public-only personal access token, let the claim list the owner's private organizations, teams and concealed memberships.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oauth2","other","personal-access-tokens","self-hosted"],"not_affected_if":["no-oauth2-userinfo-endpoint"],"how_to_check":null,"fix":"- The endpoint now uses the scope of the authenticating token; the sources do not name the fixed product versions.","status":"open","published_at":"2026-11-01T10:18:36+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","triaged_at":"2026-11-01T10:51:30+00:00","updated_at":"2026-11-01T10:51:30+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-01T10:51:30Z","model":"claude-haiku-5-5","output":{"fix":"- The endpoint now uses the scope of the authenticating token; the sources do not name the fixed product versions.","reach":"internet","title":"OAuth2 userinfo endpoint leaks private organization and team memberships to token holders","impact":"low","summary":"The OAuth2 userinfo endpoint ignored the scope of the token that authenticated the request when deciding whether to limit the groups claim to public organizations. A public-only token sent as a query parameter or form field, or a public-only personal access token, let the claim list the owner's private organizations, teams and concealed memberships.","audience":"businesses","category":"other","nicknames":[],"who_cares":["oauth2","self-hosted","personal-access-tokens"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Private organization and team memberships of the token owner are disclosed.","analyst_note":"","how_to_check":"unknown","plain_action":"","needs_analyst":false,"not_affected_if":["no-oauth2-userinfo-endpoint"],"who_is_affected":"Systems that expose the OAuth2 userinfo endpoint (`/login/oauth/userinfo`) and issue OAuth2 or personal access tokens with limited public scope. Exposure is limited to organization and team names and memberships; repository content is not exposed. The sources do not say which product or versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001004,"input_tokens":4240,"output_tokens":1160,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118394':15A,18A '-2026':14A,17A '/login/oauth/userinfo':91C 'access':23B,72B,112C,148C 'authent':39B,123C,198C 'author':107C 'back':155C 'came':154C 'claim':49B,76B,98C,159C 'conceal':85B,169C 'content':187C 'credenti':121C 'cve':13A,16A 'decid':43B,92C 'disclosur':172C 'empti':156C 'endpoint':3A,31B,90C,191C 'expos':189C 'field':65B,141C 'form':64B,140C 'group':48B,97C 'header':108C 'holder':12A 'host':27B 'ignor':32B 'instead':114C 'leak':4A 'let':74B 'limit':46B,95C,174C 'list':77B,160C 'membership':9A,86B,170C,184C 'name':182C 'oauth2':1A,19B,29B,88C,111C,131C 'organ':6A,52B,82B,101C,166C,179C 'owner':79B,163C,177C 'paramet':62B,138C 'pars':105C 'person':22B,71B,147C 'personal-access-token':21B 'privat':5A,81B,165C 'public':51B,55B,69B,100C,129C,145C 'public-on':54B,68B,128C,144C 'queri':61B,137C 're':104C 're-pars':103C 'repositori':186C 'request':41B,125C 'scope':34B,118C,153C,195C 'self':26B 'self-host':25B 'sent':58B,134C 'team':8A,83B,167C,181C 'token':11A,24B,37B,57B,73B,113C,132C,149C,162C,199C 'use':116C,151C,193C 'userinfo':2A,30B,89C 'whether':44B,93C","nicknames":[],"mitigations":[],"who_affected":"Systems that expose the OAuth2 userinfo endpoint (`/login/oauth/userinfo`) and issue OAuth2 or personal access tokens with limited public scope. Exposure is limited to organization and team names and memberships; repository content is not exposed. The sources do not say which product or versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T10:18:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118394","severity":null,"published_at":"2026-11-01T10:18:36+00:00","modified_at":"2026-11-01T10:18:36+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","fetched_at":"2026-11-01T10:49:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}