CVE-2026-55982: Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

The OIDC userinfo endpoint (GET /login/oauth/userinfo) accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims.

A personal access token scoped only to read:misc can successfully retrieve user information from the OIDC userinfo endpoint, even though the same token is denied access to user-related REST API endpoints that enforce scope checks.

As a result, identity information remains accessible through the OIDC endpoint regardless of the scopes assigned to the API token.