CVE-2026-105661
Medium
Description
Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Gitea
PublishedOct 18, 2026
First seenOct 18, 2026
Weakness typeCWE-248CWE-248CWE-476NULL pointer dereference
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Gitea Gitea | v ≤ 28.1.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.