Gitea v1.27.0 Release Blog Postrelease notes
https://blog.gitea.com/gitea-1.27.0-is-released CVE-2026-58440
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Description
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Description source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Gitea Open Source Git ServerBrowse Gitea / Gitea Open Source Git ServerDefault status: unaffected | CVE List | Through 1.26.4 | affected |
gitea.devBrowse Go / gitea.dev | GitHub Advisory | Before 1.27.0 · Fixed in 1.27.0 | affected |
References
8github.com
https://github.com/go-gitea/gitea github.com
https://github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31 github.com
https://github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf github.com
https://github.com/go-gitea/gitea/pull/38406 github.com
https://github.com/go-gitea/gitea/pull/38426 Gitea v1.27.0 Releaserelease notes
https://github.com/go-gitea/gitea/releases/tag/v1.27.0 GitHub Security AdvisoryVendor advisory
https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5