Gitea CVE-2026-105661

No special conditions - remote unauthenticated exploitation against default configurations of Gitea (≤28.1.0): the description explicitly states the request needs no authentication and no special configuration. The specific prerequisite is simply requesting the organization home route /{username}/-/repositories with a path segment that resolves to an individual user account rather than an organization, which drives the handler into a nil-organization dereference. The limiting factor is impact scope: each request only yields a recovered HTTP 500 plus a logged panic rather than a full server crash, so availability degradation is confined to error responses and log growth.

This is a genuine but low-to-moderate priority issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) correctly reflects an unauthenticated, network-reachable, low-complexity flaw whose only impact is partial availability - no confidentiality or integrity loss. All exploitation signals point away from urgency: EPSS is 0.19% (8th percentile), not in CISA KEV, and no public exploit identified at time of analysis. SSVC aligns with this (Exploitation: none, Technical Impact: partial) though it rates Automatable: yes, which is consistent with a trivially scriptable single-request trigger. The impact is self-limiting: per the description the server recovers with an HTTP 500 and merely logs a panic per request rather than crashing, so this is request-level error generation and log noise, not a persistent outage - the A:L (not A:H) rating is appropriate. Note the input Tags label this 'Information Disclosure', which contradicts the CVSS vector (C:N) and CWE-248 (uncaught exception); this is an availability/denial-of-service bug, not disclosure.

An unauthenticated attacker sends an HTTP GET to /{username}/-/repositories using an individual user's name rather than an organization. The organization home handler dereferences a nil organization and panics, returning HTTP 500 and writing a panic stack trace to the server log. Repeated automated requests generate continuous log noise and wasted error handling, but no code execution or data exposure occurs; no public PoC is identified.