CVE-2026-58440

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.4

Description A flaw exists where webhooks created by a collaborator with admin permissions on a private repository continue to trigger after the collaborator's access has been revoked. The DeleteCollaboration() function in services/repository/collaboration.go removes collaboration records, recalculates access, drops watches, and unassigns issues, but fails to remove or disable webhooks created by that user. Furthermore, the webhook delivery process does not re-validate if the creator still has access to the repository. This allows a former collaborator to receive full payloads of future repository events, including issue and comment bodies and commit data, at their controlled endpoint indefinitely and invisibly.

Recommendations Update Gitea to a version where the DeleteCollaboration() function is updated to delete or disable webhooks created by the removed collaborator, or transfer ownership of those webhooks to the repository owner. Implement a re-validation check of the creator's current repository access before each webhook delivery. As a temporary mitigation, manually audit and remove webhooks created by users whose access has been revoked.