The vulnerability allows webhooks created by a collaborator to continue firing after the collaborator’s repository access has been revoked, resulting in persistent real‑time exfiltration of private repository content. This defect indicates a failure in the repository revocation process to clean up associated webhook configurations, enabling unauthorized data disclosure. The flaw represents an authorization weakness (CWE‑284) and an incomplete cleanup (CWE‑459).

The flaw impacts the Gitea Open Source Git Server. Specific product versions are not provided, so all deployed instances should be evaluated for remediation.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation data. With a CVSS score of 6.8, the defect represents a moderate to high risk to confidentiality if exploited. The likely attack vector involves a repository administrator revoking a collaborator’s access; if the webhook remains active, that administrator can obtain confidential data through the webhook payloads. Developers should therefore treat this as a high‑severity authorization issue and address it promptly.