Is CVE-2026-103620 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103620 being exploited in the wild.

How severe is CVE-2026-103620?

Informational severity, published 6 October 2026.

Which products and versions are affected?

GitHub Enterprise Server 3.18.0–3.18.15, 3.19.0–3.19.12, 3.20.0–3.20.8, 3.21.0–3.21.6, 3.22.0–3.22.1.

Is there a fix for CVE-2026-103620?

Yes: fixed in Enterprise Server 3.18.16, 3.19.13, 3.20.9, 3.21.7, 3.22.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103620 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-103620?

Check whether you run GitHub Enterprise Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103620: GitHub Enterprise Server missing authorization in GraphQL API

CVE-2026-103620 · Severity: info · Published 2026-10-06

GitHub Enterprise Server is a self-hosted version control platform used by organizations to manage source code and collaboration. A flaw in the GraphQL API allowed users with write access to a repository to delete the default branch without proper authorization checks, potentially allowing them to bypass code review requirements and inject malicious code into the repository. An attacker with repository collaborator access could use this to compromise code integrity and cause deployments of attacker-controlled content.

Technologies: GitHub Enterprise Server. Vendors: GitHub.

Quick answers

Is CVE-2026-103620 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103620 being exploited in the wild.
How severe is CVE-2026-103620?: Informational severity, published 6 October 2026.
Which products and versions are affected?: GitHub Enterprise Server 3.18.0–3.18.15, 3.19.0–3.19.12, 3.20.0–3.20.8, 3.21.0–3.21.6, 3.22.0–3.22.1.
Is there a fix for CVE-2026-103620?: Yes: fixed in Enterprise Server 3.18.16, 3.19.13, 3.20.9, 3.21.7, 3.22.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103620 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-103620?: Check whether you run GitHub Enterprise Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Enterprise Server 3.18.16, 3.19.13, 3.20.9, 3.21.7, 3.22.2

Technical details

A missing authorization check in the GraphQL API allows authenticated repository collaborators with write access to delete the default branch and set an attacker-controlled branch as the new default. This bypasses branch protection rules that require pull request review. The vulnerability requires existing write access to the repository via the GraphQL API attack vector; no further privileges or user interaction are needed beyond the attacker being a collaborator.

Affected products

GitHub Enterprise Server 3.18.0–3.18.15, 3.19.0–3.19.12, 3.20.0–3.20.8, 3.21.0–3.21.6, 3.22.0–3.22.1

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.