CVE-2026-58440
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Webhooks created by a collaborator keep firing after their repo access is revoked, enabling ongoing real-time exfiltration of private repo content. The issue stems from incomplete revocation cleanup in `DeleteCollaboration`.
Risk Assessment
The organization is at risk of confidential data leakage from private repositories even after revoking access from former collaborators. This can lead to confidentiality breaches and loss of data control.
Recommendation
Immediately update Gitea to a patched version and verify that all webhooks associated with removed collaborators are disabled. Additionally, audit webhook activity.
Original NVD description (English source)
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)