EUVD-2026-41145
GHSA-86rx-87q3-fqhc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Token possession is the access prerequisite (PR:L); once held, exploitation is straightforward (AC:L); scope remains unchanged and impact is limited to low-severity integrity writes with no confidentiality or availability effect.
Primary rating from Vendor (GitHub_P).
CVSS VectorVendor: GitHub_P
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. This was possible because the authorization check only verified that the installation had read permissions on the target repository rather than verifying that the token's installation was explicitly granted access to that repository. An attacker who obtained a victim's user-to-server token could create issues, issue comments, commit comments, and private vulnerability reports on any public repository, appearing as the victim user with no indication of the app involvement. This vulnerability was fixed by adding a repository scope check for user-to-server tokens issued by global apps. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
AnalysisAI
Incorrect authorization in GitHub Enterprise Server allows an attacker who has obtained a victim's user-to-server token - issued by a GitHub App installation - to perform write operations on any public repository, regardless of whether that installation was explicitly granted access to the target repository. Affected installations span all GHES versions prior to 3.22, with fixes backported to six supported release trains. The CVSS 4.0 score is 5.3 (medium); no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
GitHub Apps issue user-to-server tokens to act on behalf of a user within the scope of an installation. CWE-863 (Incorrect Authorization) describes failures where a system checks the wrong condition during access control. Here, the GHES authorization layer verified only that the app installation held read permissions on the target repository - a necessary but insufficient condition - without also confirming that the calling token's specific installation was explicitly scoped to that repository. This is a logic flaw in the repository-scope check for global app installations: the coarse 'has-read-access' predicate was accepted as a proxy for 'is explicitly authorized to act here,' allowing the token to reach repositories the installation was never granted. The CPE cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:* confirms the affected component is the self-hosted GHES platform. The fix adds an explicit installation-to-repository binding check for user-to-server tokens issued by global apps.
RemediationAI
Upgrade GitHub Enterprise Server to the patched release for the installed branch: 3.16.20 (https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.20), 3.17.17 (https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17), 3.18.11 (https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11), 3.19.8 (https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8), 3.20.4 (https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4), or 3.21.2 (https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.2). If immediate patching is not feasible, restrict or audit GitHub App installations with global scope on your GHES instance; limiting which apps can operate as global apps reduces the attack surface until the patch is applied. Note that auditing existing user-to-server tokens for anomalous cross-repository writes on public repositories can help detect prior exploitation.
More in Enterprise Server
View allThe RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. R
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe
An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sig
An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Ent
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL
An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server
An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication wi
Server-side request forgery in GitHub Enterprise Server lets an unauthenticated attacker coerce the appliance into issui
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today