Threats tagged 'ghsa-hg5r-vq93-9fv6'

Gitea Actions Artifacts V4 signed URLs suffer from an HMAC signature ambiguity that allows an attacker with permission to run a Gitea Actions job to rewrite signed URLs. This enables unauthorized reading of artifacts from other repository tasks and unauthorized writing to other task artifact upload staging areas, including private repositories. The vulnerability arises because the HMAC input concatenates multiple fields without delimiters, allowing different URL parameter combinations to produce the same signature. This flaw affects versions from 1.22.0 up to but not including 1.26.2.