A flaw in Gitea Actions artifact handling creates ambiguity in HMAC validation of signed URLs, allowing an attacker to read artifacts from other repositories and to overwrite the upload state of unrelated tasks. The vulnerability is characterized by CWE‑347, which refers to improper handling and validation of data. The outcome can expose sensitive artifacts and disrupt the integrity of the artifact upload workflow.

The affected product is Gitea Open Source Git Server. No specific version range is listed in the data, but the issue was addressed in a later release of Gitea as referenced by the vendor’s advisory.

CVE‑2026‑58426 scores a CVSS of 9.6, placing it in the critical range. The EPSS score is below 1 %, indicating a very low likelihood of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to craft or obtain a signed URL that bypasses the HMAC check, enabling unauthorized reading of artifacts from other repositories and overwriting the upload state of unrelated tasks. The likely attack vector is remote via manipulation of signed URLs.