Skip to main content

Enterprise Server CVE-2025-8447

HIGH
Authorization Bypass Through User-Controlled Key (CWE-639)
2025-08-26 product-cna@github.com
Authentication Bypass Enterprise Server
7.0
CVSS 4.0 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
7.0 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Mar 28, 2026 - 19:08 vuln.today
CVE Published
Aug 26, 2025 - 02:15 nvd
HIGH 7.0

DescriptionGitHub Advisory

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program.

AnalysisAI

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-639. An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program. Affected products include: Github Enterprise Server. Version information: prior to 3.18.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Enterprise Server

View all
CVE-2013-4854 HIGH POC
7.8 Jul 29

The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and

CVE-2024-0200 CRITICAL POC
9.8 Jan 16

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. R
CVE-2024-9487 CRITICAL POC
9.5 Oct 10

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe
CVE-2024-4985 CRITICAL
10.0 May 20

An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sig
CVE-2017-7420 CRITICAL
9.8 Aug 21

An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Ent
CVE-2023-4501 CRITICAL
9.8 Sep 12

User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL

CVE-2022-46255 CRITICAL
9.8 Dec 14

An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server

CVE-2021-22869 CRITICAL
9.8 Sep 24

An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted

CVE-2024-6800 CRITICAL
9.5 Aug 20

An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication wi
CVE-2026-9312 CRITICAL
9.2 May 27

Server-side request forgery in GitHub Enterprise Server lets an unauthenticated attacker coerce the appliance into issui
CVE-2024-1378 CRITICAL
9.1 Feb 13

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol
CVE-2024-1374 CRITICAL
9.1 Feb 13

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2025-8447 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy