CVE-2026-58511: Gitea: Webhook Authorization Header Returned in Plaintext via API

The ToHook() function in services/webhook/general.go decrypts the webhook’s HeaderAuthorizationEncrypted field and returns the plaintext authorization header in the API response. Any repository admin can read the full plaintext value of webhook authorization headers (Bearer tokens, Basic auth credentials, API keys) set by other admins.

The authorization header is stored encrypted in the database using the server’s SecretKey, but ToHook() decrypts it before serializing it into the API response — converting a write-only secret into a readable credential.