Gitea Webhook Delivery Issue: Potential Ongoing Exfiltration of Private Repo Content
An issue has been reported where webhooks created by a collaborator in Gitea continue to fire even after their repository access has been revoked. This may result in ongoing exfiltration of private repository content.
What happened
It appears that a vulnerability in Gitea's webhook delivery system allows webhooks created by collaborators to continue operating after their access to the repository has been revoked. This issue is under investigation and may lead to the unauthorized exfiltration of private repository content. The affected components include `services/repository/collaboration.go` and the webhook delivery system.
Professional software engineers using Gitea are advised to review and disable or delete any webhooks created by collaborators upon revocation of their access. Critical webhooks should be handed over or transferred to the repository owner to ensure continued secure operation. For more detailed information, the primary sources should be consulted.
How 0Day mitigates this
gitea is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.