CVE-2026-55984: Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

July 21, 2026

The AddTime API handler continues execution after an error returned by GetUserByName().

When a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime panic.

References

github.com/advisories/GHSA-m932-crvm-gcp5
github.com/go-gitea/gitea/releases/tag/v1.27.0
github.com/go-gitea/gitea/security/advisories/GHSA-m932-crvm-gcp5
nvd.nist.gov/vuln/detail/CVE-2026-55984

Code Behaviors & Features

Detect and mitigate CVE-2026-55984 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →