CVE-2026-58511
Received Received - Intake

Webhook Authorization Header Disclosure via API

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
Webhook Authorization Header Returned in Plaintext via API

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-58511
EUVD
EUVD-2026-58124

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-gitea gitea to 1.26.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-58511 is a vulnerability in Gitea where webhook authorization headers are exposed in plaintext via API responses. The issue occurs because the system decrypts and returns sensitive authorization headers (like Bearer tokens or API keys) in API responses, allowing repository admins to view credentials set by other admins.

Detection Guidance

To detect this vulnerability, inspect API responses for webhook endpoints in Gitea versions up to 1.26.4. Check if authorization headers like Bearer tokens or API keys are returned in plaintext. Review logs for admin-accessed endpoints returning webhook details.

Impact Analysis

This vulnerability allows unauthorized users with admin privileges to access plaintext authorization headers, potentially leading to credential theft. Attackers could use exposed tokens or API keys to compromise external services or escalate privileges within the system.

Compliance Impact

This vulnerability may violate compliance requirements for protecting sensitive data, such as GDPR's data protection principles or HIPAA's safeguards for credentials. Exposure of plaintext authorization headers could result in unauthorized access to systems, leading to potential regulatory penalties.

Mitigation Strategies

Upgrade Gitea to a version beyond 1.26.4 where the issue is fixed. Temporarily restrict admin access to webhook endpoints until patched. Rotate exposed credentials if plaintext headers were previously visible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58511. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart