Executive brief
A security flaw was found in GitHub Enterprise Server where the authorization screen failed to show certain permissions being requested by third-party applications. An attacker could create a malicious application that secretly requests administrative access to an organization's automation runners. If a user is tricked into authorizing the app, the attacker could gain control over the infrastructure used to build and deploy software, potentially leading to unauthorized code execution or service disruption.
Technical details
A User Interface (UI) Misrepresentation of Critical Information (CWE-451) exists in GitHub Enterprise Server's OAuth flow. The vulnerability stems from the authorization consent screen failing to display the 'manage_runners:org' scope when requested by an OAuth application. An attacker can exploit this by inducing a victim with sufficient privileges to authorize a malicious application, thereby granting the attacker unintended access to manage the organization's self-hosted runners. This issue affected all versions prior to 3.22 and has been patched in several maintenance releases including 3.21.2 and 3.16.20.
Affected products
- GitHub Enterprise Server < 3.22, fixed in 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched
- 2026-06-30: advisory
References
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.21/admin/release-notes