GitHub Enterprise Server CVE-2026-103620

Requires an authenticated repository collaborator with write access (PR:L). The repository must be configured to require pull-request review but must NOT restrict branch deletion - this exact configuration state is the AT:P attack requirement; repos that restrict branch deletion are not exploitable. Exploitation is performed remotely via the GraphQL API against supported GitHub Enterprise Server 3.18-3.22 instances prior to the fix releases. Limiting factors: the attacker must already hold write access (no unauthenticated or read-only path), the specific review-without-deletion-restriction configuration must exist, and impact is confined to default-branch integrity (no data disclosure or denial of service).

This is a genuine but bounded integrity issue rather than a top-tier emergency. The CVSS 4.0 base score of 6.0 (Medium) is driven by VI:H with VC:N and VA:N - the flaw lets an attacker corrupt the integrity of a repository's default branch but cannot read data or cause outages. Several signals agree it is not a mass-exploitation threat: PR:L requires an authenticated collaborator who already has write access, AT:P indicates a specific configuration prerequisite must be met, and the issue was found and reported privately through the GitHub Bug Bounty program rather than discovered in attacks. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real risk is contextual: in environments that rely on pull-request review as a merge-protection control but have not also restricted branch deletion, a semi-trusted insider (or a compromised collaborator account) can bypass that review gate and poison what new clones and default-branch API calls receive - a supply-chain-style integrity concern that matters most for organizations with many low-trust write collaborators. For tightly controlled repos with few trusted maintainers, real-world risk is low.

A repository collaborator with only write access (e.g., an outside contributor or a compromised low-privilege account) targets a repo that requires pull-request review but does not restrict branch deletion. Using the GraphQL API over the network, they delete the protected default branch and have their own attacker-controlled branch promoted to default, so fresh clones and default-branch API requests silently serve their unreviewed code, bypassing the review requirement. No public exploit code is identified in the available data.