CVE-2026-58426

CriticalCVSS 9.6

Published: 03/07/2026(UTC)Updated: 06/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The vulnerability in Gitea Actions Artifacts V4 stems from HMAC ambiguity in signed URLs, allowing cross-repository artifact read and cross-task upload-state write.

Risk Assessment

An attacker can access confidential data stored as artifacts in other repositories or manipulate upload state, leading to data integrity and confidentiality breaches.

Recommendation

Immediately update Gitea to a version containing the fix that resolves the HMAC ambiguity in signed URLs and verify artifact access permission configurations.

Original NVD description (English source)

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write