{"items":[{"id":"NVI-00016405","kind":"vulnerability","title":"Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-m932-crvm-gcp5","CVE-2026-55984"],"plain_summary":"GitHub lists this reviewed advisory for code.gitea.io/gitea. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5fb89e318094447abb9a5614432104a7"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-21T20:59:14.000Z","value":"2.7 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6e4d1888d69aa074374ec5c501a57e3e"},{"kind":"CVSS","as_of":"2026-08-26T16:53:48.300Z","value":"2.7 LOW (3.1)","meaning":"134c704f-9b21-4f2e-91b3-4a467353bcc0 severity; no combined Null risk score.","source_id":"sr-5fb89e318094447abb9a5614432104a7"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6e4d1888d69aa074374ec5c501a57e3e","url":"https://github.com/advisories/GHSA-m932-crvm-gcp5","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-m932-crvm-gcp5","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:34:39.734Z"},{"id":"sr-5fb89e318094447abb9a5614432104a7","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55984","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-55984","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T01:48:33.286Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6e4d1888d69aa074374ec5c501a57e3e"],"technology":"code.gitea.io/gitea","known_exclusions":[],"conditions_summary":"### Summary\n\nThe AddTime API handler continues execution after an error returned by `GetUserByName()`.\n\nWhen a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime panic.\n\n### Details\n\nAffected endpoint:\n\n```http\nPOST /api/v1/repos/{owner}/{repo}/issues/{index}/times\n```\n\nAffected file:\n\n```text\nrouters/api/v1/repo/issue_tracked_time.go\n```\n\nRelevant code:\n\n```go\nuser, err = user_model.GetUserByName(ctx, form.User)\nif err != nil {\n    ctx.APIErrorInternal(err)\n    // missing return\n}\n```\n\nExecution continues to:\n\n```go\ntrackedTime, err := issues_model.AddTime(\n    ctx,\n    user,\n    issue,\n    form.Time,\n    created,\n)\n```\n\nWhen `GetUserByName()` fails, `user` is nil.\n\nThe subsequent call dereferences the nil pointer and triggers a runtime panic.\n\n### Proof of Concept\n\nUsing a repository administrator account:\n\n```http\nPOST /api/v1/repos/owner/repo/issues/1/times\nContent-Type: application/json\n\n{\n  \"time\": 3600,\n  \"user_name\": \"nonexistent_user_xyz\"\n}\n```\n\nResult:\n\n```text\nHTTP 500\nruntime error: invalid memory address or nil pointer dereferenc","public_affected_ranges":["< 1.27.0"]}],"null_published_at":"2026-11-08T19:53:44.061Z","source_updated_at":"2026-07-21T20:59:14.000Z","source_disclosed_at":"2026-07-21T20:59:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-03T22:34:39.734Z"},{"id":"NVI-00016405","kind":"vulnerability","title":"Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-m932-crvm-gcp5","CVE-2026-55984"],"plain_summary":"GitHub lists this reviewed advisory for code.gitea.io/gitea. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6e4d1888d69aa074374ec5c501a57e3e"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-21T20:59:14.000Z","value":"2.7 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6e4d1888d69aa074374ec5c501a57e3e"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6e4d1888d69aa074374ec5c501a57e3e","url":"https://github.com/advisories/GHSA-m932-crvm-gcp5","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-m932-crvm-gcp5","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:34:39.734Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6e4d1888d69aa074374ec5c501a57e3e"],"technology":"code.gitea.io/gitea","known_exclusions":[],"conditions_summary":"### Summary\n\nThe AddTime API handler continues execution after an error returned by `GetUserByName()`.\n\nWhen a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime panic.\n\n### Details\n\nAffected endpoint:\n\n```http\nPOST /api/v1/repos/{owner}/{repo}/issues/{index}/times\n```\n\nAffected file:\n\n```text\nrouters/api/v1/repo/issue_tracked_time.go\n```\n\nRelevant code:\n\n```go\nuser, err = user_model.GetUserByName(ctx, form.User)\nif err != nil {\n    ctx.APIErrorInternal(err)\n    // missing return\n}\n```\n\nExecution continues to:\n\n```go\ntrackedTime, err := issues_model.AddTime(\n    ctx,\n    user,\n    issue,\n    form.Time,\n    created,\n)\n```\n\nWhen `GetUserByName()` fails, `user` is nil.\n\nThe subsequent call dereferences the nil pointer and triggers a runtime panic.\n\n### Proof of Concept\n\nUsing a repository administrator account:\n\n```http\nPOST /api/v1/repos/owner/repo/issues/1/times\nContent-Type: application/json\n\n{\n  \"time\": 3600,\n  \"user_name\": \"nonexistent_user_xyz\"\n}\n```\n\nResult:\n\n```text\nHTTP 500\nruntime error: invalid memory address or nil pointer dereferenc","public_affected_ranges":["< 1.27.0"]}],"null_published_at":"2026-11-04T10:04:27.941Z","source_updated_at":"2026-07-21T20:59:14.000Z","source_disclosed_at":"2026-07-21T20:59:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T22:34:39.734Z"}],"next_cursor":null,"snapshot_revision":"42594"}