CVE-2026-105661: Gitea panic on the repositories route of individual users
Requesting /{username}/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the failure?
Any unauthenticated remote requester can trigger it by requesting the repositories route for an individual user. No special configuration is required.
What is the impact of a successful request?
Each request causes the server to return HTTP 500 and log a panic. The corrected behavior is HTTP 404 when the route is used for an individual user.
How can I identify attempted exploitation or exposure in logs?
Look for HTTP 500 responses and corresponding panic logs associated with requests matching /{username}/-/repositories where the username belongs to an individual user.