CVE-2026-58511

CVE-2026-58511 concerns Gitea where the webhook authorization header is decrypted and exposed in plaintext via the API. The connected advisories detail that the ToHook() function reads the webhook’s HeaderAuthorizationEncrypted field, decrypts it with the server secret, and returns the plaintext ...