Improper access control in Gitea - CVE-2026-58440
Published: July 14, 2026
Vulnerability identifier: #VU137412
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58440
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in DeleteCollaboration and webhook delivery when handling repository events after collaborator access is revoked. A remote privileged user can create a webhook on a private repository before revocation to disclose sensitive information.
The webhook may remain active after the collaborator loses repository access, and future event payloads can include issue and comment bodies and commit data sent to an attacker-controlled endpoint.
Affected software
Gitea
How to mitigate CVE-2026-58440
Install security update from vendor's website.
Gitea - update to 1.27.0