fkie_cve-2026-58511

Webhook Authorization Header Returned in Plaintext via API

GHSA-3r5c-2xxx-h872 — Gitea: Webhook Authorization Header Returned in Plaintext via API

Affected: Go: code.gitea.io/gitea

## Summary

The `ToHook()` function in `services/webhook/general.go` decrypts the webhook's `HeaderAuthorizationEncrypted` field and returns the plaintext authorization header in the API response. Any repository admin can read the full plaintext value of webhook authorization headers (Bearer tokens, Basic auth credentials, API keys) set by other admins.

The authorization header is stored encrypted in the database using the server's `SecretKey`, but `ToHook()` decrypts it before serializing it into the API response — converting a write-only secret into a readable credential.

## Vulnerable Code

**File:** `services/webhook/general.go:407-420`

```go func ToHook(repoLink string, w *webhook_model.Webhook) (*api.Hook, error) { // ... authorizationHeader, err := w.HeaderAuthorization() // DECRYPTS from DB if err != nil { return nil, err } return &api.Hook{ // ... AuthorizationHeader: authorizationHeader, // PLAINTEXT in response // ... }, nil } ```

**Decryption function:** `models/webhook/webhook.go:209-216`

```go func (w Webhook) HeaderAuthorization() (string, error) { if w.HeaderAuthorizationEncrypted == "" { return "", nil } return secret.DecryptSecret(setting.SecretKey, w.HeaderAuthorizationEncrypted) } ```

## Affected Endpoints

All call `ToHook()`: - `GET /api/v1/repos/{owner}/{repo}/hooks` (requires repo admin) - `GET /api/v1/repos/{owner}/{repo}/hooks/{id}` (requires repo admin) - `GET /api/…

Most recent entries from all

fkie_cve-2026-58511

GHSA-3r5c-2xxx-h872 — Gitea: Webhook Authorization Header Returned in Plaintext via API