In woodpecker versions prior to 3.15.0, the /api/orgs/lookup/*org_full_name endpoint is registered without authentication middleware. The LookupOrg handler unconditionally dereferences the session user object, which is nil for unauthenticated requests, causing a NULL pointer dereference. Although the gin recovery middleware prevents server crashes by recovering from the panic and returning HTTP 500 errors, each such request generates a multi-line panic stack trace in the error logs. An unauthenticated attacker can exploit this to repeatedly trigger the panic, flooding logs and inflating disk usage and log ingestion costs.

The vulnerability does not allow data disclosure, integrity compromise, or direct service disruption beyond returning HTTP 500 errors. However, it enables an unauthenticated attacker to cause a denial of service in the form of log flooding, which can increase disk usage and obscure legitimate log entries, potentially hindering incident response and monitoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing network-level controls to restrict access to the vulnerable endpoint or deploying web application firewall rules to detect and block repeated unauthenticated requests to /api/orgs/lookup/*org_full_name. Monitor logs for unusual volumes of panic stack traces and investigate accordingly.