CVE-2026-105661

Received Received - Intake

HTTP 500 Panic in GitLab for Invalid User Repository Request

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-105661

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when a request is made to the path /{username}/-/repositories for an individual user instead of an organization. The server's organization home handler fails to handle this case properly, dereferencing a nil organization and causing a panic. The server responds with an HTTP 500 error and logs the panic for each such request.

Detection Guidance

This vulnerability causes HTTP 500 errors when accessing /{username}/-/repositories for individual users. Check web server logs for repeated 500 errors on such requests. No special commands are needed beyond monitoring HTTP responses.

Impact Analysis

This vulnerability can cause the server to crash with an HTTP 500 error when an unauthenticated user requests a user's repositories path. It disrupts service availability and may lead to denial of service for legitimate users.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it only causes a server-side panic and HTTP 500 error without exposing sensitive data or violating access controls.

Mitigation Strategies

Apply the latest Gitea patch to fix the nil dereference issue. Ensure the server returns 404 instead of 500 for invalid user repository requests. Monitor logs for continued 500 errors as an indicator of unpatched systems.

Hi! I’m here to help you understand CVE-2026-105661. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70