An unauthenticated HTTP request to /api/orgs/lookup/*org_full_name in Woodpecker versions prior to 3.15.0 forces the LookupOrg handler to dereference a nil session user, causing a null‑pointer exception. The panic is caught by gin's recovery middleware, the server returns a 500 response, and the full stack trace is written to the error log with each request. Repeating this behavior floods the log file with about 37 lines per request, quickly consuming disk space and inflating the cost of downstream log ingestion services. The result is a denial‑of‑service condition in which legitimate log entries are buried and infrastructure resources are exhausted.

Woodpecker CI (woodpecker-ci:woodpecker) version 3.14 and earlier are vulnerable. The issue was discovered in a commit on October 13, 2023, and a fix was included in the 3.15.0 release. Systems running any version below 3.15.0 without appropriate access controls to the /api/orgs/lookup endpoint are affected.

The CVSS score of 6.9 indicates a moderate severity, and the vulnerability is accessible without authentication, making exploitation trivial for any external actor with network visibility to the server. While the EPSS score is not recorded, the lack of authentication and the straightforward nature of the attack vector suggest a non‑negligible exploitation probability. The vulnerability is not currently listed in CISA's KEV catalog, but the potential for resource exhaustion and cost inflation warrants prompt remediation.