What is the CVSS score of CVE-2026-58426?

CVE-2026-58426 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Gitea are affected by CVE-2026-58426?

Gitea versions before v1.26.2 contain a critical flaw in artifact signing that allows authenticated users to access private artifacts and modify CI/CD tasks across unrelated repositories, bypassing…. A patch is available.

How to fix or mitigate CVE-2026-58426?

24 hours: Inventory all Gitea instances in production; identify which run versions prior to v1.26.2 with Actions enabled; disable Actions if v1.26.2 cannot be deployed within 48 hours. 7 days: Deploy Gitea v1.26.2 (vendor-released patch) or later across all affected instances; confirm Actions Artifacts V4 signed-URL validation is enabled. 30 days: Audit artifact access logs for cross-repository access; review user repository and task permissions for unauthorized access; rotate credentials from any exposed private artifacts.

Gitea CVE-2026-58426

EUVD-2026-41608 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-03 Gitea

GHSA-hg5r-vq93-9fv6

Jwt Attack Gitea Information Disclosure Gitea Open Source Git Server Suse

9.6

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

An authenticated Actions user (PR:L) exploits a low-complexity network flaw that crosses the repository boundary (S:C) to read private artifacts (C:H) and write cross-task state (I:H); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:56 vuln.today

DescriptionCVE.org

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

AnalysisAI

Cross-repository information disclosure and cross-task tampering in Gitea's self-hosted Git server (fixed in v1.26.2) arises from an HMAC signature ambiguity in the Actions Artifacts V4 signed-URL scheme, letting an authenticated low-privilege user reuse a validly signed URL outside its intended repository or task context. An attacker with access to a single Actions task can read private artifacts belonging to other repositories and write upload-state for tasks they do not own, crossing the repository trust boundary (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Gitea Actions is the built-in CI/CD subsystem (a self-hosted GitHub Actions-compatible runner protocol). The Artifacts V4 API issues time-limited signed URLs that authorize a runner to upload and download build artifacts; those URLs are authenticated with an HMAC over parameters identifying the repository, task/run and artifact. The root cause is CWE-347 (Improper Verification of Cryptographic Signature): because the HMAC is computed over an ambiguous or under-constrained set of fields, a signature legitimately produced for one repository/task can be interpreted as valid for a different one - a classic signature-scope/canonicalization ambiguity. The affected component is cpe:2.3:a:gitea:gitea_open_source_git_server, and the tags (Information Disclosure, JWT/token-style attack) reflect that the flaw lives in the token/URL signing logic rather than in artifact storage itself.

RemediationAI

Vendor-released patch: upgrade to Gitea v1.26.2 (https://github.com/go-gitea/gitea/releases/tag/v1.26.2), which corrects the Artifacts V4 signed-URL HMAC validation per the fix in pull request https://github.com/go-gitea/gitea/pull/37707 and advisory GHSA-hg5r-vq93-9fv6. If immediate upgrade is not possible, reduce exposure by disabling Gitea Actions (turn the actions feature off in app.ini) or by restricting who can register accounts and run workflows - accepting that this halts CI/CD on the instance. On multi-tenant or public instances, tightening runner access and shortening artifact retention lowers the value of any cross-repository read; note these are stopgaps that do not close the signature ambiguity, so patching to 1.26.2 remains the only complete fix.