NULL pointer dereference in Gitea - CVE-2026-55984
Published: July 14, 2026
Vulnerability identifier: #VU137427
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55984
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the AddTime API handler in routers/api/v1/repo/issue_tracked_time.go when handling POST requests to add tracked time with a non-existent user name. A remote privileged user can send a specially crafted API request to cause a denial of service.
Depending on deployment configuration and panic recovery behavior, exploitation may also result in request failures, stack trace disclosure, or excessive log generation.
Affected software
Gitea
How to mitigate CVE-2026-55984
Install security update from vendor's website.
Gitea - update to 1.27.0