{"schema_version":"1.9.0","id":"GHSA-m932-crvm-gcp5","published":"2026-07-21T20:59:14Z","modified":"2026-07-27T17:11:23.116619690Z","aliases":["CVE-2026-55984","GO-2026-6064"],"summary":"Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service","details":"### Summary\n\nThe AddTime API handler continues execution after an error returned by `GetUserByName()`.\n\nWhen a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime panic.\n\n### Details\n\nAffected endpoint:\n\n```http\nPOST /api/v1/repos/{owner}/{repo}/issues/{index}/times\n```\n\nAffected file:\n\n```text\nrouters/api/v1/repo/issue_tracked_time.go\n```\n\nRelevant code:\n\n```go\nuser, err = user_model.GetUserByName(ctx, form.User)\nif err != nil {\n    ctx.APIErrorInternal(err)\n    // missing return\n}\n```\n\nExecution continues to:\n\n```go\ntrackedTime, err := issues_model.AddTime(\n    ctx,\n    user,\n    issue,\n    form.Time,\n    created,\n)\n```\n\nWhen `GetUserByName()` fails, `user` is nil.\n\nThe subsequent call dereferences the nil pointer and triggers a runtime panic.\n\n### Proof of Concept\n\nUsing a repository administrator account:\n\n```http\nPOST /api/v1/repos/owner/repo/issues/1/times\nContent-Type: application/json\n\n{\n  \"time\": 3600,\n  \"user_name\": \"nonexistent_user_xyz\"\n}\n```\n\nResult:\n\n```text\nHTTP 500\nruntime error: invalid memory address or nil pointer dereference\n```\n\nThe stack trace indicates execution reaches the AddTime code path with a nil user object.\n\n### Impact\n\nAn authenticated repository administrator can repeatedly trigger server-side panics through the affected endpoint.\n\nDepending on deployment configuration and panic recovery behavior, this may result in request failures, stack trace disclosure, excessive log generation, or degraded service availability.\n\n### Suggested Fix\n\nAdd a return statement after the error response:\n\n```go\nuser, err = user_model.GetUserByName(ctx, form.User)\nif err != nil {\n    ctx.APIErrorInternal(err)\n    return\n}\n```","affected":[{"package":{"name":"code.gitea.io/gitea","ecosystem":"Go","purl":"pkg:golang/code.gitea.io/gitea"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-m932-crvm-gcp5/GHSA-m932-crvm-gcp5.json"}}],"references":[{"type":"WEB","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-m932-crvm-gcp5"},{"type":"PACKAGE","url":"https://github.com/go-gitea/gitea"},{"type":"WEB","url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0"}],"database_specific":{"cwe_ids":["CWE-476"],"github_reviewed":true,"github_reviewed_at":"2026-07-21T20:59:14Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"}]}