Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-105661

Gitea panic on the repositories route of individual users

Description

Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Gitea Gitea

Default version status: unaffected

  • 0 to ≤ 28.1.0affected

References