Executive brief
Gitea is an open-source forge software package for hosting software development version control using Git. A vulnerability in the webhook management system allows repository administrators to view sensitive authorization headers, such as API keys and Bearer tokens, in plain text through the API. This could allow a malicious or compromised administrator to steal credentials used to authenticate with external services, potentially leading to unauthorized access to those third-party platforms.
Technical details
An information exposure vulnerability exists in Gitea's webhook API due to improper handling of encrypted secrets. The `ToHook()` function in `services/webhook/general.go` calls `HeaderAuthorization()`, which decrypts the `HeaderAuthorizationEncrypted` field from the database using the server's `SecretKey`. This decrypted plaintext value is then serialized directly into the API response. An attacker with repository administrator privileges can call endpoints such as `GET /api/v1/repos/{owner}/{repo}/hooks` to retrieve plaintext Bearer tokens, Basic auth credentials, or API keys configured for webhooks. This vulnerability is patched in version 1.27.0 by ensuring the authorization header is treated as write-only.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: disclosed
- 2026-07-13: patched: Fixed in version 1.27.0
- 2026-07-21: advisory