Description
Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Gitea | Gitea | ≤ 28.1.0 | — |
References
- GitHub Security Advisory GHSA-c3cr-qq9g-666c vendor-advisory
- Fix: go-gitea/gitea pull request #39839 patch
- Fix backport to release/v28: go-gitea/gitea pull request #39847 patch
- Gitea 28.2.0 release announcement release-notes
- go-gitea/gitea v28.2.0 release release-notes