CVE-2026-58426: Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permission to run a Gitea Actions job can turn a signed URL for an attacker-controlled artifact into a URL that reads artifacts from another task context, or writes attacker-controlled data into another task’s artifact upload staging context, including in a private repository.

This is one vulnerability with two exploit paths:

• DownloadArtifact: cross-task/cross-repository artifact read, giving C:H.
• UploadArtifact: cross-task artifact staging write and metadata mutation, giving I:H.