This vulnerability in Gitea version 1.22.0 arises from ambiguity in the HMAC signing mechanism used for Gitea Actions Artifacts V4 signed URLs. Due to this ambiguity, an attacker with limited privileges can read artifacts across repositories and write upload states across tasks, violating repository isolation and task integrity. The issue is tracked as CWE-347 (Improper Verification of Cryptographic Signature). The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high impact on confidentiality and integrity. No vendor advisory or patch is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with some privileges to bypass repository boundaries and access artifacts from other repositories, as well as modify upload states across tasks. This compromises confidentiality and integrity of data managed by Gitea Actions, potentially exposing sensitive information and corrupting workflow states. Availability is not impacted. The vulnerability affects the security isolation model of Gitea Actions artifacts and task management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Gitea Actions artifacts and monitor for unusual cross-repository or cross-task activity. Avoid granting unnecessary privileges to users to limit exploitation potential.