Vulnerability in Gitea Actions Artifacts Signed URL Management
CVE-2026-58426

9.6CRITICAL

Key Information:

Vendor

Gitea

Status
Gitea Open Source Git Server
Vendor
CVE Published:
3 July 2026

What is CVE-2026-58426?

A vulnerability exists in Gitea Actions Artifacts (V4) where ambiguous handling of signed URLs for HMAC can lead to unauthorized access across repositories and potentially allow for inappropriate state manipulation during task uploads. This may allow an attacker to read artifacts from another repository or alter the upload state of tasks compounding security risks. Users are advised to update to the latest version to mitigate these risks.

Affected Version(s)

Gitea Open Source Git Server 1.22.0 <= 1.26.1

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/37707
patch
https://github.com/go-gitea/gitea/releases/tag/v1.26.2
release-notes

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kamil-sawicki
.