Description
Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.
Title Gitea panic on the repositories route of individual users
Weaknesses CWE-248
CWE-476
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Gitea

Published:

Updated: 2026-10-18T18:56:41.198Z

Reserved: 2026-10-14T20:08:45.842Z

Link: CVE-2026-105661

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T19:16:32.590

Modified: 2026-10-18T19:16:32.590

Link: CVE-2026-105661

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses