← All advisories

Critical severity9.6NVD Advisory· Published Jul 3, 2026· Updated Jul 6, 2026

CVE-2026-58426

CVE-2026-58426

Description

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
code.gitea.io/giteaGo	>= 1.22.0, < 1.26.2	1.26.2

Affected products

2

Go Gitea/Giteallm-fuzzy
osv-coords
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Range: < 0.0.20260727T201416-160000.1.1

Patches

Vulnerability mechanics

References

8

github.com/advisories/GHSA-hg5r-vq93-9fv6ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-58426ghsaADVISORY
blog.gitea.com/release-of-1.26.2ghsaWEB
github.com/go-gitea/gitea/commit/1c2d5e9b03f71dd12d450b2af9a79f2557b50226ghsaWEB
github.com/go-gitea/gitea/pull/37707nvdWEB
github.com/go-gitea/gitea/releases/tag/v1.26.2nvdWEB
github.com/go-gitea/gitea/security/advisories/GHSA-hg5r-vq93-9fv6nvdWEB
blog.gitea.com/release-of-1.26.2/nvd

News mentions

0

No linked articles in our index yet.