https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:03:31.600291+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352917 EUVD-2026-352917 2026-10-02T11:03:31.619748+00:00 EUVD-2026-352917 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58440 fkie_cve-2026-58440 2026-10-02T11:03:31.619783+00:00

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

 https://cve.radiocsirt.org/vuln/ghsa-66m4-5jjr-2rg5 GHSA-66m4-5jjr-2rg5 — Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltrati… 2026-10-02T11:03:31.619816+00:00

Affected: Go: gitea.dev

## Affected product Gitea — `services/repository/collaboration.go` (`DeleteCollaboration`) + webhook delivery

## Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup `DeleteCollaboration` removes the collaboration record, recalculates accesses, drops watches, and unassigns issues — but it does **not** remove or disable webhooks the user created, and webhook delivery never re-checks whether the creator still has repo access. The former collaborator therefore receives the full payload (issue/comment bodies, commit data) of all future repository events at their controlled endpoint, indefinitely and invisibly.

## Affected code - `services/repository/collaboration.go` → `DeleteCollaboration()` — cleans watches/assignees only; no webhook cleanup. - Webhook delivery path — fires on repo events without re-validating the creator's current access.

## Steps to reproduce Using the provided reproduction materials: 1. Attacker (admin collaborator) creates a webhook → revoke access. 2. Control: `GET /api/v1/repos/admin/wh-repo` (attacker) → **404**. 3. `GET .../hooks` → webhook still `active=true`. 4. Admin creates a new issue **after** revocation → the catcher receives `action:"opened"`, `issue.title:"CRITICAL SECRET: …"`, `issue.body` (sentinel private key), `repository.private:true`. (Runtime-confirmed on `gitea/gitea:1.25.4`. Catcher is an internal…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 WID-SEC-W-2026-2304 — Gitea: Mehrere Schwachstellen 2026-10-02T11:03:31.619866+00:00

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.