Server-Side Bug in Gitea Affects User Repository Requests
CVE-2026-105661

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
18 October 2026

What is CVE-2026-105661?

A vulnerability in Gitea allowed unauthorized requests to individual user repository paths, causing the organization handler to encounter a nil dereference and trigger a server panic, resulting in HTTP 500 error responses. This situation arose from requests that required no authentication or specific configuration, exposing the server to potential disruptions. The fix implemented changes to ensure that requests made for individual users return a 404 status, thereby preventing the server from experiencing such failures.

Affected Version(s)

Gitea 0 <= 28.1.0

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/39839
patch
https://github.com/go-gitea/gitea/pull/39847
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/kewmine
https://github.com/tienpa99
https://github.com/gemstone-source
https://github.com/silverwind
https://github.com/wxiaoguang
https://github.com/bircni
.