Executive brief
Gitea, a popular self-hosted code hosting platform, contains a flaw where webhooks created by a collaborator remain active even after that person's access to a private repository is revoked. This allows a former collaborator to continue receiving real-time updates, including sensitive code changes, issue comments, and commit data, without the repository owner's knowledge. This could lead to the long-term, invisible theft of intellectual property or private credentials.
Technical details
An authorization residue vulnerability exists in Gitea's `DeleteCollaboration` service. When a collaborator's access is revoked, the application cleans up watches and assignments but fails to remove or deactivate webhooks created by that user. Furthermore, the webhook delivery mechanism does not re-validate the creator's current permissions before firing. An attacker with temporary admin-level collaborator access can create a webhook pointing to an external server; after their access is revoked, the webhook continues to send full event payloads (including private issue bodies and commit data) to the attacker's endpoint. The issue is fixed in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: advisory: Initial advisory published by Gitea team
- 2026-07-21: advisory: GitHub Advisory Database entry published
- 2026-07-21: patched: Fix released in version 1.27.0