# CVE-2026-75101: GitHub Enterprise Server authorization bypass in pull request diffs

Source: https://junglewise.ai/threats/cve-2026-75101-an-authorization-bypass-vulnerability-was-identified-in-github  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-75101 · Severity: info · Published 2026-09-22

GitHub Enterprise Server contained an authorization bypass that allowed any authenticated user to read private pull request diffs and patches by replicating the target repository name and pull request number. An attacker could exploit this if they knew the target repository's name and a valid pull request number, potentially exposing sensitive code changes and proprietary information from private repositories.

Technologies: [GitHub Enterprise Server](https://junglewise.ai/threats/technologies/github-enterprise-server). Vendors: [GitHub](https://junglewise.ai/threats/vendors/github).

## Quick answers

**Is CVE-2026-75101 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75101 being exploited in the wild.

**How severe is CVE-2026-75101?** Informational severity, published 22 September 2026.

**Which products and versions are affected?** GitHub Enterprise Server all versions prior to 3.22; fixed in 3.17.21, 3.18.15, 3.19.12, 3.20.8, 3.21.6.

**Is there a fix for CVE-2026-75101?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75101 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75101?** Check whether you run GitHub Enterprise Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stemmed from access tokens for raw pull request diffs and patches being scoped to repository name and PR number rather than a globally unique repository identifier. An authenticated attacker could create a repository and pull request matching the target's naming and request number, then use their own token to retrieve the private PR's contents. This affected all versions prior to 3.22.

## Affected products

- GitHub Enterprise Server all versions prior to 3.22; fixed in 3.17.21, 3.18.15, 3.19.12, 3.20.8, 3.21.6

## Timeline

- 2026-09-22: disclosed

## References

- [https://docs.github.com/en/enterprise-server@3.17/admin/release-notes](https://docs.github.com/en/enterprise-server@3.17/admin/release-notes)
- [https://docs.github.com/en/enterprise-server@3.18/admin/release-notes](https://docs.github.com/en/enterprise-server@3.18/admin/release-notes)

## Related threats

- [GitHub Enterprise Server out-of-bounds read in SSH key negotiation](https://junglewise.ai/threats/cve-2026-118237-an-out-of-bounds-read-vulnerability-was-identified-in-github)
- [GitHub Enterprise Server CSRF in ChatOps integration removal](https://junglewise.ai/threats/cve-2026-110288-a-cross-site-request-forgery-vulnerability-was-identified-in)
- [GitHub Enterprise Server use-after-free in Git service babeld](https://junglewise.ai/threats/cve-2026-104608-a-remote-code-execution-vulnerability-was-identified-in-github)
- [GitHub Enterprise Server SSRF in secret scanning validator](https://junglewise.ai/threats/cve-2026-96890-a-server-side-request-forgery-ssrf-vulnerability-was-identified)
- [GitHub Enterprise Server missing authorization in GraphQL API](https://junglewise.ai/threats/cve-2026-103620-a-missing-authorization-vulnerability-was-identified-in-github)