CVE-2026-55984

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The AddTime API handler fails to stop execution after an error is returned by the GetUserByName() function. When a repository administrator provides a non-existent user name, the system generates an error response but continues to process the request. This leads to a nil pointer dereference when the code attempts to use the user object, resulting in a runtime panic. An authenticated repository administrator can exploit this behavior via the '/api/v1/repos/{owner}/{repo}/issues/{index}/times' endpoint by providing an invalid user name parameter. This can lead to request failures, disclosure of stack traces, or degraded service availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/api/v1/repos/{owner}/{repo}/issues/{index}/times' endpoint to minimize the risk of exploitation.