Martijnperdaan52

**Name of the Vulnerable Software and Affected Versions** Email Management API (affected versions not specified) **Description** The Email Management API contains a flaw that allows the bypass of restrictions within the ManageCredentials feature. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** The AddTime API handler fails to stop execution after an error is returned by the `GetUserByName()` function. When a repository administrator provides a non-existent user name, the system generates an error response but continues to process the request. This leads to a nil pointer dereference when the code attempts to use the user object, resulting in a runtime panic. An authenticated repository administrator can exploit this behavior via the '/api/v1/repos/{owner}/{repo}/issues/{index}/times' endpoint by providing an invalid `user name` parameter. This can lead to request failures, disclosure of stack traces, or degraded service availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/api/v1/repos/{owner}/{repo}/issues/{index}/times' endpoint to minimize the risk of exploitation.