Information disclosure in Gitea - CVE-2026-58511
Published: July 14, 2026
Vulnerability identifier: #VU137450
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58511
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in the ToHook() function in services/webhook/general.go when handling API requests for webhook data. A remote privileged user can retrieve webhook details to disclose sensitive information.
The issue exposes plaintext webhook authorization headers, including Bearer tokens, Basic authentication credentials, and API keys, that were configured by other administrators.
Affected software
Gitea
How to mitigate CVE-2026-58511
Install security update from vendor's website.
Gitea - update to 1.27.0