Vulnerability · Published Oct 18, 2026 · Assigned by Gitea
CVE-2026-105661Gitea panic on the repositories route of individual users
Medium 5.3
In plain English
A medium-severity null pointer dereference in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 72.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.
Affected products (as reported)
Weakness: CWE-248, CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- GitHub Security Advisory GHSA-c3cr-qq9g-666c vendor-advisory
- Fix: go-gitea/gitea pull request #39839 patch
- Fix backport to release/v28: go-gitea/gitea pull request #39847 patch
- Gitea 28.2.0 release announcement release-notes
- go-gitea/gitea v28.2.0 release release-notes