CVE-2026-58369

MediumCVSS 5.3

Published: 30/06/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

Woodpecker before version 3.15.0 exposes the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user (user.ForgeID via ForgeFromUser) when selecting the forge to query. For an unauthenticated request, session.User returns nil, causing a NULL pointer dereference and panic. The panic is recovered by gin recovery middleware and the server continues serving (returning HTTP 500), but each request writes a multi-line panic stack trace to the error log.

Risk Assessment

An unauthenticated attacker can repeatedly probe the endpoint, causing approximately 37 lines of panic stack trace per request, leading to excessive disk usage, increased log ingestion costs, and burying legitimate log events.

Recommendation

Immediately upgrade Woodpecker to version 3.15.0 or later, which includes the fix for this vulnerability. As a temporary workaround, restrict access to the /api/orgs/lookup/* endpoint using firewall rules or a reverse proxy.

Other vulnerabilities in Woodpecker

CVE-2026-58370High
A vulnerability in Woodpecker before version 3.15.0 allows bypassing the ApprovalAllowedUsers list by manipulating the pipeline.Author field. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) in the webhook payload, which is attacker-controlled and not verified by GitLab. A user opening a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing needsApproval to return false and the pipeline to run without required approval.

Original NVD description (English source)

Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user (user.ForgeID, via ForgeFromUser) when selecting the forge to query. For an unauthenticated request session.User returns nil, so any unauthenticated HTTP request triggers a NULL pointer dereference in the handler. The panic is recovered by gin recovery middleware and the server continues serving (returning HTTP 500), but each request writes a multi-line panic stack trace to the error log. A low-bandwidth unauthenticated attacker can repeatedly probe the endpoint to flood the logs (about 37 lines per request), inflating disk usage and downstream log-ingestion cost and burying legitimate log events.