Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service occurs when an authenticated user sends a request to the AddTime endpoint of Gitea. The null pointer dereference leads to the application crashing or becoming unresponsive, effectively disabling the Git server for that session or the entire instance. The weakness is classified as an access control flaw (CWE-284) because it allows authenticated users to trigger a service disruption.

The affected product is the Gitea open source Git server. The security advisory indicates that the issue is fixed in release 1.27.0. No explicit list of vulnerable versions is provided, so all releases prior to 1.27.0 that still use the vulnerable AddTime API are potentially exposed.

Because the exploit requires authentication, the typical attack vector is a logged‑in user. No public exploit code is documented, and the EPSS score is less than 1%, indicating a very low probability of exploitation. The CVSS score of 2.7 reflects a low severity vulnerability. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been observed in the wild. Nevertheless, any authenticated user can cause a denial of service, which can disrupt development workflows and service availability.