In Gitea versions before 1.27.0, webhooks established by collaborators with admin rights on private repositories are not properly invalidated when those collaborators lose access. The webhook delivery system fails to re-verify the current access rights of the webhook creator, enabling continued firing of webhooks and delivery of sensitive repository event data to unauthorized parties. This vulnerability is tracked as CVE-2026-58440 and is classified under CWE-863 (Incorrect Authorization).

The vulnerability allows unauthorized exfiltration of private repository content through persistent webhook deliveries to former collaborators. Confidential information contained in repository events can be leaked indefinitely after access revocation, potentially compromising sensitive data. The CVSS 3.1 base score is 6.8 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact.

An official patch is available in Gitea version 1.27.0 that addresses this issue by ensuring webhook creators' access is re-validated before webhook delivery. Users should upgrade to version 1.27.0 or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the patch. No additional mitigation steps are indicated by the vendor advisory.