{"id":"GHSA-66m4-5jjr-2rg5","summary":"Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content","details":"## Affected product\nGitea — `services/repository/collaboration.go` (`DeleteCollaboration`) + webhook delivery\n\n## Summary\nWhen a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing\nafter the collaborator's access is revoked. Gitea's revocation cleanup `DeleteCollaboration` removes the\ncollaboration record, recalculates accesses, drops watches, and unassigns issues — but it does **not**\nremove or disable webhooks the user created, and webhook delivery never re-checks whether the creator still\nhas repo access. The former collaborator therefore receives the full payload (issue/comment bodies, commit\ndata) of all future repository events at their controlled endpoint, indefinitely and invisibly.\n\n## Affected code\n- `services/repository/collaboration.go` → `DeleteCollaboration()` — cleans watches/assignees only; no\n  webhook cleanup.\n- Webhook delivery path — fires on repo events without re-validating the creator's current access.\n\n## Steps to reproduce\nUsing the provided reproduction materials:\n1. Attacker (admin collaborator) creates a webhook → revoke access.\n2. Control: `GET /api/v1/repos/admin/wh-repo` (attacker) → **404**.\n3. `GET .../hooks` → webhook still `active=true`.\n4. Admin creates a new issue **after** revocation → the catcher receives `action:\"opened\"`,\n   `issue.title:\"CRITICAL SECRET: …\"`, `issue.body` (sentinel private key), `repository.private:true`.\n(Runtime-confirmed on `gitea/gitea:1.25.4`. Catcher is an internal sentinel listener; the payload is a\nplanted sentinel, not real data; nothing is sent to any external/metadata endpoint.)\n\n## Impact\nAuthenticated former admin-collaborator → ongoing real-time exfiltration of private content created after\nrevocation; invisible to the owner; scope crosses from the application boundary to data the user should no\nlonger access.\n\n## Suggested remediation\n1. On revocation, delete/disable webhooks created by the removed collaborator (or hand them to the owner).\n2. Re-validate the creator's current repo access before each webhook delivery.\n3. At minimum, warn admins on revocation if the user created webhooks.\n\n## Credit\nReported as part of an incomplete-patch / authorization-residue measurement study (responsible disclosure).","aliases":["CVE-2026-58440","GO-2026-6033"],"modified":"2026-07-22T21:39:09.861245999Z","published":"2026-07-21T20:11:36Z","database_specific":{"cwe_ids":["CWE-863"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-21T20:11:36Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5"},{"type":"WEB","url":"https://github.com/go-gitea/gitea/pull/38406"},{"type":"WEB","url":"https://github.com/go-gitea/gitea/pull/38426"},{"type":"WEB","url":"https://github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31"},{"type":"WEB","url":"https://github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf"},{"type":"PACKAGE","url":"https://github.com/go-gitea/gitea"},{"type":"WEB","url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0"}],"affected":[{"package":{"name":"gitea.dev","ecosystem":"Go","purl":"pkg:golang/gitea.dev"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-66m4-5jjr-2rg5/GHSA-66m4-5jjr-2rg5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"}]}