---
id: "CVE-2026-118394"
kind: "vulnerability"
aliases: ["CVE-2026-118394"]
title: "OAuth2 userinfo endpoint leaks private organization and team memberships to token holders"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["oauth2", "other", "personal-access-tokens", "self-hosted"]
not_affected_if: ["no-oauth2-userinfo-endpoint"]
published_at: "2026-11-01T10:18:36+00:00"
first_seen_at: "2026-11-01T10:49:33+00:00"
updated_at: "2026-11-01T10:51:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118394", "first_seen_at": "2026-11-01T10:49:33+00:00"}]
---

# OAuth2 userinfo endpoint leaks private organization and team memberships to token holders

The OAuth2 userinfo endpoint ignored the scope of the token that authenticated the request when deciding whether to limit the groups claim to public organizations. A public-only token sent as a query parameter or form field, or a public-only personal access token, let the claim list the owner's private organizations, teams and concealed memberships.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- The endpoint now uses the scope of the authenticating token; the sources do not name the fixed product versions.

## Timeline

- 2026-11-01T10:49:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118394

## From the sources

The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_