Vulnerability advisory
CVE-2026-58426
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
Also known as GHSA-hg5r-vq93-9fv6GO-2026-6060
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/go-gitea/gitea ↗ | |
| d7f73a1334ab7a97d4e055b7c58cdd9ac303f77a to before 2c749ce548b1da0a52835861a87b888e67842d29 | 2c749ce548b1da0a52835861a87b888e67842d29 |
Also listed as affected (11)
| |
Description
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
References
- Advisoryblog.gitea.com/release-of-1.26.2/ ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58426.json ↗
- Advisorygithub.com/go-gitea/gitea/releases/tag/v1.26.2 ↗
- Advisorygithub.com/go-gitea/gitea/security/advisories/GHSA-hg5r-vq93-9fv6 ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-58426 ↗
- Fixgithub.com/go-gitea/gitea/pull/37707 ↗