GHSA-3R5C-2XXX-H872

Vulnerability from github – Published: 2026-07-21 21:52 – Updated: 2026-07-21 21:52
VLAI
Summary
Gitea: Webhook Authorization Header Returned in Plaintext via API
Details

Summary

The ToHook() function in services/webhook/general.go decrypts the webhook's HeaderAuthorizationEncrypted field and returns the plaintext authorization header in the API response. Any repository admin can read the full plaintext value of webhook authorization headers (Bearer tokens, Basic auth credentials, API keys) set by other admins.

The authorization header is stored encrypted in the database using the server's SecretKey, but ToHook() decrypts it before serializing it into the API response — converting a write-only secret into a readable credential.

Vulnerable Code

File: services/webhook/general.go:407-420

func ToHook(repoLink string, w *webhook_model.Webhook) (*api.Hook, error) {
    // ...
    authorizationHeader, err := w.HeaderAuthorization()  // DECRYPTS from DB
    if err != nil {
        return nil, err
    }
    return &api.Hook{
        // ...
        AuthorizationHeader: authorizationHeader,  // PLAINTEXT in response
        // ...
    }, nil
}

Decryption function: models/webhook/webhook.go:209-216

func (w Webhook) HeaderAuthorization() (string, error) {
    if w.HeaderAuthorizationEncrypted == "" {
        return "", nil
    }
    return secret.DecryptSecret(setting.SecretKey, w.HeaderAuthorizationEncrypted)
}

Affected Endpoints

All call ToHook(): - GET /api/v1/repos/{owner}/{repo}/hooks (requires repo admin) - GET /api/v1/repos/{owner}/{repo}/hooks/{id} (requires repo admin) - GET /api/v1/admin/hooks (requires site admin) - GET /api/v1/orgs/{org}/hooks (requires org admin) - GET /api/v1/user/hooks (requires authenticated user)

Steps to Reproduce

  1. Admin A creates a webhook with a sensitive authorization header.
  2. Admin B (different repo admin) lists webhooks via GET /api/v1/repos/{owner}/{repo}/hooks.
  3. The API response includes the full plaintext authorization header set by Admin A.

Impact

  • Cross-admin secret exposure on shared repositories
  • Credential harvesting if a repo admin's Gitea token is stolen
  • External service compromise via leaked Bearer tokens and API keys
  • Undermines the intentional encryption-at-rest protection

Suggested Fix

The authorization header should be write-only. Return a masked/redacted version or a boolean has_authorization_header flag instead.

References

  • Vulnerable function: services/webhook/general.go:392-425
  • Decryption function: models/webhook/webhook.go:209-216
  • Verified against commit 19f0169
Severity
2.7 (Low)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-58511"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T21:52:49Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\nThe `ToHook()` function in `services/webhook/general.go` decrypts the webhook\u0027s `HeaderAuthorizationEncrypted` field and returns the plaintext authorization header in the API response. Any repository admin can read the full plaintext value of webhook authorization headers (Bearer tokens, Basic auth credentials, API keys) set by other admins.\n\nThe authorization header is stored encrypted in the database using the server\u0027s `SecretKey`, but `ToHook()` decrypts it before serializing it into the API response \u2014 converting a write-only secret into a readable credential.\n\n## Vulnerable Code\n\n**File:** `services/webhook/general.go:407-420`\n\n```go\nfunc ToHook(repoLink string, w *webhook_model.Webhook) (*api.Hook, error) {\n    // ...\n    authorizationHeader, err := w.HeaderAuthorization()  // DECRYPTS from DB\n    if err != nil {\n        return nil, err\n    }\n    return \u0026api.Hook{\n        // ...\n        AuthorizationHeader: authorizationHeader,  // PLAINTEXT in response\n        // ...\n    }, nil\n}\n```\n\n**Decryption function:** `models/webhook/webhook.go:209-216`\n\n```go\nfunc (w Webhook) HeaderAuthorization() (string, error) {\n    if w.HeaderAuthorizationEncrypted == \"\" {\n        return \"\", nil\n    }\n    return secret.DecryptSecret(setting.SecretKey, w.HeaderAuthorizationEncrypted)\n}\n```\n\n## Affected Endpoints\n\nAll call `ToHook()`:\n- `GET /api/v1/repos/{owner}/{repo}/hooks` (requires repo admin)\n- `GET /api/v1/repos/{owner}/{repo}/hooks/{id}` (requires repo admin)\n- `GET /api/v1/admin/hooks` (requires site admin)\n- `GET /api/v1/orgs/{org}/hooks` (requires org admin)\n- `GET /api/v1/user/hooks` (requires authenticated user)\n\n## Steps to Reproduce\n\n1. Admin A creates a webhook with a sensitive authorization header.\n2. Admin B (different repo admin) lists webhooks via `GET /api/v1/repos/{owner}/{repo}/hooks`.\n3. The API response includes the full plaintext authorization header set by Admin A.\n\n## Impact\n\n- Cross-admin secret exposure on shared repositories\n- Credential harvesting if a repo admin\u0027s Gitea token is stolen\n- External service compromise via leaked Bearer tokens and API keys\n- Undermines the intentional encryption-at-rest protection\n\n## Suggested Fix\n\nThe authorization header should be write-only. Return a masked/redacted version or a boolean `has_authorization_header` flag instead.\n\n## References\n\n- Vulnerable function: `services/webhook/general.go:392-425`\n- Decryption function: `models/webhook/webhook.go:209-216`\n- Verified against commit 19f0169",
  "id": "GHSA-3r5c-2xxx-h872",
  "modified": "2026-07-21T21:52:49Z",
  "published": "2026-07-21T21:52:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-3r5c-2xxx-h872"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gitea: Webhook Authorization Header Returned in Plaintext via API"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.