CVE-2026-58440

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

CVE-2026-58440

CVE-2026-58440 (Gitea) : The issue stems from incomplete revocation cleanup. When a collaborator with admin rights revokes repo access, the function DeleteCollaboration() cleans collaboration records, recalculates permissions, and stops watches, but it does not remove or disable webhooks created ...