# CVE-2026-103620: GitHub Enterprise Server missing authorization in GraphQL API

Source: https://junglewise.ai/threats/cve-2026-103620-a-missing-authorization-vulnerability-was-identified-in-github  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-103620 · Severity: info · Published 2026-10-06

GitHub Enterprise Server is a self-hosted version control platform used by organizations to manage source code and collaboration. A flaw in the GraphQL API allowed users with write access to a repository to delete the default branch without proper authorization checks, potentially allowing them to bypass code review requirements and inject malicious code into the repository. An attacker with repository collaborator access could use this to compromise code integrity and cause deployments of attacker-controlled content.

Technologies: [GitHub Enterprise Server](https://junglewise.ai/threats/technologies/github-enterprise-server). Vendors: [GitHub](https://junglewise.ai/threats/vendors/github).

## Quick answers

**Is CVE-2026-103620 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103620 being exploited in the wild.

**How severe is CVE-2026-103620?** Informational severity, published 6 October 2026.

**Which products and versions are affected?** GitHub Enterprise Server 3.18.0–3.18.15, 3.19.0–3.19.12, 3.20.0–3.20.8, 3.21.0–3.21.6, 3.22.0–3.22.1.

**Is there a fix for CVE-2026-103620?** Yes: fixed in Enterprise Server 3.18.16, 3.19.13, 3.20.9, 3.21.7, 3.22.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103620 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-103620?** Check whether you run GitHub Enterprise Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Enterprise Server 3.18.16, 3.19.13, 3.20.9, 3.21.7, 3.22.2

## Technical details

A missing authorization check in the GraphQL API allows authenticated repository collaborators with write access to delete the default branch and set an attacker-controlled branch as the new default. This bypasses branch protection rules that require pull request review. The vulnerability requires existing write access to the repository via the GraphQL API attack vector; no further privileges or user interaction are needed beyond the attacker being a collaborator.

## Affected products

- GitHub Enterprise Server 3.18.0–3.18.15, 3.19.0–3.19.12, 3.20.0–3.20.8, 3.21.0–3.21.6, 3.22.0–3.22.1

## Timeline

- 2026-10-06: disclosed

## References

- [https://docs.github.com/en/enterprise-server@3.18/admin/release-notes](https://docs.github.com/en/enterprise-server@3.18/admin/release-notes)
- [https://docs.github.com/en/enterprise-server@3.19/admin/release-notes](https://docs.github.com/en/enterprise-server@3.19/admin/release-notes)

## Related threats

- [GitHub Enterprise Server out-of-bounds read in SSH key negotiation](https://junglewise.ai/threats/cve-2026-118237-an-out-of-bounds-read-vulnerability-was-identified-in-github)
- [GitHub Enterprise Server CSRF in ChatOps integration removal](https://junglewise.ai/threats/cve-2026-110288-a-cross-site-request-forgery-vulnerability-was-identified-in)
- [GitHub Enterprise Server use-after-free in Git service babeld](https://junglewise.ai/threats/cve-2026-104608-a-remote-code-execution-vulnerability-was-identified-in-github)
- [GitHub Enterprise Server SSRF in secret scanning validator](https://junglewise.ai/threats/cve-2026-96890-a-server-side-request-forgery-ssrf-vulnerability-was-identified)
- [GitHub Enterprise Server notebook viewer SSRF](https://junglewise.ai/threats/cve-2026-77987-a-server-side-request-forgery-ssrf-vulnerability-was-identified)