Executive brief
GitHub Enterprise Server, a platform used by organizations to host and manage software code, contained a flaw in how it verified permissions for third-party applications. An attacker who obtained a specific type of application token could perform unauthorized actions, such as creating issues or comments, on public repositories they weren't supposed to access. These actions would appear to come directly from a legitimate user, potentially leading to misinformation or unauthorized changes in public projects.
Technical details
An incorrect authorization vulnerability (CWE-863) existed in GitHub Enterprise Server where authorization checks for user-to-server (u2s) tokens only verified if a GitHub App installation had read permissions on a target repository, rather than verifying explicit access for that specific token. A network-based attacker with a victim's u2s token could perform write operations—including creating issues, commit comments, and private vulnerability reports—on any public repository. These actions would impersonate the victim user without indicating the app's involvement. The issue was resolved by implementing a repository scope check for tokens issued by global apps. Fixes are available in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20.
Affected products
- GitHub Enterprise Server < 3.22, 3.21.0-3.21.1, 3.20.0-3.20.3, 3.19.0-3.19.7, 3.18.0-3.18.10, 3.17.0-3.17.16, 3.16.0-3.16.19
Timeline
- 2026-06-30: patched: Release of version 3.16.20 with security fixes
- 2026-07-01: advisory: CVE published by NVD and GitHub
References
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.21/admin/release-notes