{"id":"CVE-2026-55984","aliases":["GHSA-m932-crvm-gcp5"],"title":"Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service","summary":"Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service","severity":"low","cvss":2.7,"cwe":["CWE-476"],"vendor":"gitea","product":"code.gitea.io/gitea","ecosystem":"go","affected":["code.gitea.io/gitea < 1.27.0"],"patched":["code.gitea.io/gitea 1.27.0"],"published":"2026-07-21","updated":"2026-07-21","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-m932-crvm-gcp5","references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-m932-crvm-gcp5"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0"},{"url":"https://github.com/advisories/GHSA-m932-crvm-gcp5"}],"tags":["ghsa","go"],"ingestedAt":"2026-07-21T21:54:47.530Z","epss":0.00336,"epssPercentile":0.2699,"slug":"CVE-2026-55984","body":"## Overview\n\n### Summary\n\nThe AddTime API handler continues execution after an error returned by `GetUserByName()`.\n\nWhen a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime panic.\n\n### Details\n\nAffected endpoint:\n\n```http\nPOST /api/v1/repos/{owner}/{repo}/issues/{index}/times\n```\n\nAffected file:\n\n```text\nrouters/api/v1/repo/issue_tracked_time.go\n```\n\nRelevant code:\n\n```go\nuser, err = user_model.GetUserByName(ctx, form.User)\nif err != nil {\n    ctx.APIErrorInternal(err)\n    // missing return\n}\n```\n\nExecution continues to:\n\n```go\ntrackedTime, err := issues_model.AddTime(\n    ctx,\n    user,\n    issue,\n    form.Time,\n    created,\n)\n```\n\nWhen `GetUserByName()` fails, `user` is nil.\n\nThe subsequent call dereferences the nil pointer and triggers a runtime panic.\n\n### Proof of Concept\n\nUsing a repository administrator account:\n\n```http\nPOST /api/v1/repos/owner/repo/issues/1/times\nContent-Type: application/json\n\n{\n  \"time\": 3600,\n  \"user_name\": \"nonexistent_user_xyz\"\n}\n```\n\nResult:\n\n```text\nHTTP 500\nruntime error: invalid memory address or nil pointer dereference\n```\n\nThe stack trace indicates execution reaches the AddTime code path with a nil user object.\n\n### Impact\n\nAn authenticated repository administrator can repeatedly trigger server-side panics through the affected endpoint.\n\nDepending on deployment configuration and panic recovery behavior, this may result in request failures, stack trace disclosure, excessive log generation, or degraded service availability.\n\n### Suggested Fix\n\nAdd a return statement after the error response:\n\n```go\nuser, err = user_model.GetUserByName(ctx, form.User)\nif err != nil {\n    ctx.APIErrorInternal(err)\n    return\n}\n```\n\n## Affected packages\n\n- `code.gitea.io/gitea < 1.27.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `code.gitea.io/gitea 1.27.0`","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}