CVE-2026-58440 — Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of…

CVE-2026-58440

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) PUBLISHED

Description (CNA)

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

Affected (CNA)

Vendor / product	Versions
Gitea / Gitea Open Source Git Server	affected 0 through 1.26.4

CWE

CWE-284

References

https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
https://blog.gitea.com/gitea-1.27.0-is-released/

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5