Unauthenticated Endpoint Vulnerability in Woodpecker by Adjusted Solutions

CVE-2026-58369

What is CVE-2026-58369?

The Woodpecker CI software before version 3.15.0 is vulnerable to a notable security issue where the /api/orgs/lookup/*org_full_name endpoint lacks adequate authentication controls. An unauthenticated attacker can exploit this vulnerability by sending requests to the endpoint, triggering a NULL pointer dereference in the LookupOrg handler due to the absence of a session user context. While the server continues to operate and returns an HTTP 500 status, this misuse results in excessive log outputs, inflating disk usage and complicating log management by obscuring legitimate entries. This poses a risk of denial of service through log flooding, making it essential for users to upgrade to the latest version to mitigate this issue.

References