Executive brief
GitHub Enterprise Server is a self-hosted platform for software development and version control. A security flaw allowed unauthorized individuals to create local user accounts even when the system was configured to require a central identity provider (like Okta or Active Directory). While these unauthorized accounts only have basic permissions, they could allow an attacker to gain a foothold within the organization's development environment.
Technical details
A missing authentication check (CWE-306) was identified in the signup endpoint of GitHub Enterprise Server. When external authentication (such as SAML, LDAP, or CAS) was enabled, the endpoint failed to properly enforce these restrictions, allowing unauthenticated network attackers to create local accounts and establish sessions without identity provider validation. The resulting accounts are restricted to the default base permissions configured on the instance. The vulnerability affects all versions prior to 3.21 and has been patched in maintenance releases 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.
Affected products
- GitHub Enterprise Server < 3.21, fixed in 3.20.2, 3.19.6, 3.18.9, 3.17.15, 3.16.18
Timeline
- 2026-05-07: disclosed
- 2026-05-07: patched
- 2026-05-07: advisory
References
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes