A nil dereference in Gitea’s organization home handler causes a panic when an unauthenticated request is made to the "/{username}/-/repositories" route for an individual user. The error leads the server to return an HTTP 500 response and logs a panic trace for each request. The vulnerability involves a null pointer dereference (CWE-476) and unexpected nil value handling (CWE-248), representing a denial‑of‑service flaw because repeated requests can exhaust resources and destabilize the application, though no direct data disclosure is indicated.

The vulnerability affects installations of Gitea running any version prior to the release that fixed the bug. The fix was included in Gitea v28.2.0; therefore, older deployments remain at risk. No other vendors or products are listed in the CNA data.

The flaw can be triggered remotely without authentication or special configuration by accessing the vulnerable endpoint. The CVSS score of 5.3 reflects moderate impact, but the EPSS score of <1% indicates an extremely low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, further suggesting limited public exploitation. While unauthenticated access widens the attack surface, the combination of low EPSS and absence of a KEV listing means that real-world attacks are expected to be infrequent.