Gitea Webhook Issue: Potential Ongoing Data Exfiltration
An issue has been reported where Gitea webhooks created by collaborators may continue to operate even after their access has been revoked. This could potentially lead to ongoing, real-time exfiltration of private repository content.
What happened
According to early reports, webhooks set up by collaborators in Gitea may not be properly disabled or deleted when the collaborator's access is revoked. This appears to allow the webhooks to continue firing, potentially enabling unauthorized access and exfiltration of private repository data.
Professional software engineers using Gitea are advised to review and update their webhook management policies to ensure that webhooks are disabled or deleted when a collaborator's access is revoked. This issue is currently under investigation, and further details should be obtained from the primary sources listed.
How 0Day mitigates this
gitea is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.