Executive brief
Gitea is a popular self-hosted software development platform. A security flaw in its Actions component allows an attacker with permission to run a job to access or modify data belonging to other users or private repositories. This could lead to the theft of sensitive build artifacts or the injection of malicious code into other projects' deployment pipelines.
Technical details
A cryptographic ambiguity exists in Gitea Actions Artifacts V4 due to the insecure concatenation of fields (artifactName, taskID, and artifactID) when generating HMAC signatures for upload and download URLs. Because these fields are concatenated without delimiters or length-prefixing, an attacker can craft overlapping values that result in the same HMAC input, effectively forging a valid signature for a different task or repository. After signature verification, the server trusts URL-controlled parameters to look up the target artifact without re-verifying repository access. This allows an authenticated attacker to read private artifacts or write data into the staging area of another task's artifact. The vulnerability is patched in version 1.26.2.
Affected products
- Gitea Gitea >= 1.22.0, < 1.26.2
Timeline
- 2026-07-01: disclosed
- 2026-07-21: advisory
- 1.26.2: patched