GitHub Enterprise Server CVE-2026-3307

Q: What is the CVSS score of CVE-2026-3307?

CVE-2026-3307 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-24520 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-21 product-cna@github.com

Authentication Bypass Enterprise Server

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

PR:L for required repository admin credentials; S:C because the action crosses repository authorization boundaries to modify a distinct impacted component.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:30 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 23:22 euvd

EUVD-2026-24520

CVE Published

Apr 21, 2026 - 23:16 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the owner_id parameter in the request body. Authorization was verified against the repository in the URL, but the action was applied to a different repository specified in the request body. The impact is limited to assigning existing trusted users as bypass reviewers; it does not allow adding arbitrary external users. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program.

AnalysisAI

Authorization bypass in GitHub Enterprise Server allows a repository admin to hijack secret scanning push protection delegated bypass reviewer lists on repositories they do not administer. The server authorizes requests against the repository specified in the URL path but applies the configuration change to the repository identified by the attacker-controlled owner_id parameter in the request body - a classic IDOR pattern (CWE-639). Impact is constrained: an attacker can only assign existing trusted users within the instance as bypass reviewers, not introduce arbitrary external accounts. No public exploit exists and EPSS is 0.05% (14th percentile); patched releases are available for all supported GHES branches.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) describes a flaw where authorization logic relies on a user-supplied identifier rather than a server-enforced reference. Here, the GitHub Enterprise Server API endpoint for managing secret scanning push protection delegated bypass reviewer lists performs its authorization check against the repository in the request URL, but executes the state change against the repository identified by the owner_id parameter in the POST body. This decoupling between the authorization subject and the action target is the root cause. The affected feature - delegated bypass for push protection - is part of GitHub Advanced Security, which allows designated reviewer users to approve requests to bypass secret scanning push rules. CPE data confirms the affected product is cpe:2.3:a:github:enterprise_server across all branches from 3.14 through 3.20.0.

RemediationAI

Upgrade to one of the patched releases: 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, or 3.20.1. Release notes confirming each fix are available at the respective GitHub docs pages referenced in NVD (e.g., https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1 and equivalents for each branch). If immediate patching is not feasible, administrators should audit and restrict the pool of accounts holding repository admin access across the instance, reducing the number of principals capable of exploiting this bypass. Periodically reviewing delegated bypass reviewer lists on repositories containing sensitive secrets can surface unauthorized modifications. Note that narrowing admin access may affect CI/CD pipelines and automation that rely on elevated repository permissions - test changes in a staging environment before applying broadly. No workaround fully eliminates the vulnerability without patching.