CVE-2026-58440

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58440", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-06-30T18:57:20.616Z", "datePublished": "2026-08-13T16:44:54.496Z", "dateUpdated": "2026-08-14T19:59:35.049Z"}, "containers": {"cna": {"title": "Webhooks created by a collaborator keep firing after their repo access is revoked \u2192 ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)", "descriptions": [{"lang": "en", "value": "Webhooks created by a collaborator keep firing after their repo access is revoked \u2192 ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)"}], "affected": [{"vendor": "Gitea", "product": "Gitea Open Source Git Server", "versions": [{"version": "0", "lessThanOrEqual": "1.26.4", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284", "lang": "en", "type": "CWE"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5", "name": "GitHub Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0", "name": "Gitea v1.27.0 Release", "tags": ["release-notes"]}, {"url": "https://blog.gitea.com/gitea-1.27.0-is-released/", "name": "Gitea v1.27.0 Release Blog Post", "tags": ["release-notes"]}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-08-13T16:44:54.496Z"}, "credits": [{"lang": "en", "value": "sec-reex", "type": "reporter"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T19:58:47.519084Z", "id": "CVE-2026-58440", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T19:59:35.049Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-58440", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T19:58:47.519084Z"}}}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T19:59:30.636Z"}}], "cna": {"title": "Webhooks created by a collaborator keep firing after their repo access is revoked \u2192 ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)", "credits": [{"lang": "en", "type": "reporter", "value": "sec-reex"}], "affected": [{"vendor": "Gitea", "product": "Gitea Open Source Git Server", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.26.4"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5", "name": "GitHub Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0", "name": "Gitea v1.27.0 Release", "tags": ["release-notes"]}, {"url": "https://blog.gitea.com/gitea-1.27.0-is-released/", "name": "Gitea v1.27.0 Release Blog Post", "tags": ["release-notes"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Webhooks created by a collaborator keep firing after their repo access is revoked \u2192 ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284"}]}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-08-13T16:44:54.496Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58440", "state": "PUBLISHED", "dateUpdated": "2026-08-14T19:59:35.049Z", "dateReserved": "2026-06-30T18:57:20.616Z", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "datePublished": "2026-08-13T16:44:54.496Z", "assignerShortName": "Gitea"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Gitea Open Source Git Server", "vendor": "Gitea", "versions": [{"lessThanOrEqual": "1.26.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Webhooks created by a collaborator keep firing after their repo access is revoked \u2192 ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)"}], "id": "CVE-2026-58440", "lastModified": "2026-08-26T16:53:48.300", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58440", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-14T19:58:47.519084Z", "version": "2.0.3"}}]}, "published": "2026-08-13T17:17:28.020", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://blog.gitea.com/gitea-1.27.0-is-released/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "type": "Secondary"}]}

{"bugzilla": {"description": "gitea.dev: Gitea: Information disclosure via incomplete webhook revocation", "id": "2515499", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515499"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-459", "details": ["Webhooks created by a collaborator keep firing after their repo access is revoked \u2192 ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)", "A flaw was found in Gitea. Webhooks created by a collaborator continue to function even after their repository access is revoked. This incomplete revocation allows for the ongoing, real-time exfiltration of private repository content, leading to information disclosure."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, repository administrators should manually audit and delete all webhooks created by a collaborator immediately upon revoking their access."}, "name": "CVE-2026-58440", "package_state": [{"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9", "product_name": "OpenShift Pipelines"}], "public_date": "2026-08-13T16:44:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58440\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58440\nhttps://blog.gitea.com/gitea-1.27.0-is-released/\nhttps://github.com/go-gitea/gitea/releases/tag/v1.27.0\nhttps://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5"], "statement": "A flaw was found in Gitea's `DeleteCollaboration` function. When a collaborator's repository access is revoked, existing webhooks created by that user remain active instead of being disabled or removed. An attacker who previously held collaborator permissions can leverage these orphaned webhooks to continuously exfiltrate event payloads and sensitive private repository content without authorization.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.26.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Gitea Open Source Git Server", "source": "cna", "vendor": "Gitea"}, "product": "gitea_open_source_git_server", "vendor": "gitea"}], "created": "2026-08-13T19:00:12.283586+00:00", "updated": "2026-08-22T10:30:17.481017+00:00", "vendors": ["gitea", "gitea$PRODUCT$gitea_open_source_git_server"]}