[ CVE-2026-105661 · Published 18 Oct 2026 ]
Vulnerability in Gitea
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.