{"id":"CVE-2026-55984","aliases":["GHSA-m932-crvm-gcp5","GO-2026-6064"],"url":"https://o3.security/vulnerability/CVE-2026-55984","summary":"Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service","details":"### Summary\n\nThe AddTime API handler continues execution after an error returned by `GetUserByName()`.\n\nWhen a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime panic.\n\n### Details\n\nAffected endpoint:\n\n```http\nPOST /api/v1/repos/{owner}/{repo}/issues/{index}/times\n```\n\nAffected file:\n\n```text\nrouters/api/v1/repo/issue_tracked_time.go\n```\n\nRelevant code:\n\n```go\nuser, err = user_model.GetUserByName(ctx, form.User)\nif err != nil {\n    ctx.APIErrorInternal(err)\n    // missing return\n}\n```\n\nExecution continues to:\n\n```go\ntrackedTime, err := issues_model.AddTime(\n    ctx,\n    user,\n    issue,\n    form.Time,\n    created,\n)\n```\n\nWhen `GetUserByName()` fails, `user` is nil.\n\nThe subsequent call dereferences the nil pointer and triggers a runtime panic.\n\n### Proof of Concept\n\nUsing a repository administrator account:\n\n```http\nPOST /api/v1/repos/owner/repo/issues/1/times\nContent-Type: application/json\n\n{\n  \"time\": 3600,\n  \"user_name\": \"nonexistent_user_xyz\"\n}\n```\n\nResult:\n\n```text\nHTTP 500\nruntime error: invalid memory address or nil pointer dereference\n```\n\nThe stack trace indicates execution reaches the AddTime code path with a nil user object.\n\n### Impact\n\nAn authenticated repository administrator can repeatedly trigger server-side panics through the affected endpoint.\n\nDepending on deployment configuration and panic recovery behavior, this may result in request failures, stack trace disclosure, excessive log generation, or degraded service availability.\n\n### Suggested Fix\n\nAdd a return statement after the error response:\n\n```go\nuser, err = user_model.GetUserByName(ctx, form.User)\nif err != nil {\n    ctx.APIErrorInternal(err)\n    return\n}\n```","published":"2026-08-13T16:44:40.619Z","modified":"2026-10-21T02:58:40.663675481Z","cvss":{"score":2.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"},"epss":{"score":0.00336,"percentile":0.2672,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"code.gitea.io/gitea","fixedVersion":"1.27.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://blog.gitea.com/gitea-1.27.0-is-released/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55984.json"},{"type":"ADVISORY","url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0"},{"type":"ADVISORY","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-m932-crvm-gcp5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55984"},{"type":"PACKAGE","url":"https://github.com/go-gitea/gitea"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:40.663675481Z"}}