All vulnerabilities
CVE-2026-105661GHSA-c3cr-qq9g-666c

Gitea panic on the repositories route of individual users

Gitea Gitea
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in28.2.0Fixed versionGitHub
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 28.2.0gitea.dev, goGitHubgo get gitea.dev@v28.2.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Requesting /{username}/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.

Text from CVE List

Affected versions 2

  • Giteaaffected: all versions through 28.1.0CVE List
  • gitea.dev, go<= 28.1.0GitHub

References 5