Executive brief
A security vulnerability in GitHub Enterprise Server could allow an authorized user to view source code in private repositories they are not permitted to access. By using a specific feature in the Copilot pull request summary tool, a user with access to at least one repository could trick the system into showing code differences from other restricted projects. This could lead to the unauthorized exposure of sensitive intellectual property or proprietary code.
Technical details
A missing authorization vulnerability (CWE-862) was identified in the Copilot pull request description diff summary endpoint of GitHub Enterprise Server. The endpoint accepted cross-repository comparison ranges and rendered the resulting diff without verifying if the requesting user had authorization for the target repository. An attacker requires an authenticated account on the instance with read access to at least one repository to serve as a comparison base. Successful exploitation allows the unauthorized viewing of source code from private repositories. The issue is fixed in GitHub Enterprise Server versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4.
Affected products
- GitHub Enterprise Server 3.17.0 - 3.17.16, 3.18.0 - 3.18.10, 3.19.0 - 3.19.7, 3.20.0 - 3.20.3
Timeline
- 2026-06-30: advisory
- 2026-06-30: patched