The vulnerability in Gitea Actions Artifacts V4 arises from the construction of the HMAC signature over concatenated URL parameters (endpoint, expires, artifactName, taskID, artifactID) without delimiters or length-prefixing. This allows crafted URL tuples to produce identical HMAC inputs, enabling an attacker to forge signed URLs that access or modify artifacts in different task and repository contexts. The signed URL handlers do not authenticate requests beyond verifying the HMAC and rely on URL parameters to identify tasks and artifacts. Consequently, an attacker can perform cross-repository artifact reads (confidentiality impact) and cross-task artifact staging writes (integrity impact). The vulnerability affects Gitea code.gitea.io/gitea versions >=1.22.0 and <1.26.2. No official patch or remediation level is stated in the advisory, and no known exploits in the wild are reported.

An attacker with permission to run Gitea Actions jobs can exploit this vulnerability to read artifacts from other tasks and repositories, potentially exposing sensitive data (high confidentiality impact). Additionally, the attacker can write attacker-controlled data into the artifact upload staging area of other tasks, causing unauthorized modification of artifact metadata and staged content (high integrity impact). There is no reported impact on availability. The vulnerability enables cross-repository and cross-task unauthorized access and modification of artifacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to run Gitea Actions jobs to trusted users only to limit exploitation potential. Monitor for updates from Gitea regarding patches or official mitigations addressing this vulnerability.