GitHub Enterprise Server CVE-2026-5845

Exploitation requires an authenticated attacker (PR:L) with an existing GitHub App installation whose lifecycle they can manipulate: the attack is triggered specifically by revoking or deleting an installation so that GHES applies its authorization fallback and treats it as a global installation context. The attacker must also win a token-revocation timing window and leverage Git-over-SSH push attribution to capture and reuse a victim-scoped ghu_ token (captured by the CVSS AT:P attack requirement and the high-complexity chaining). Limiting factors: it is not usable by an unauthenticated outsider, it is not automatable per CISA SSVC, it depends on a race condition rather than a deterministic request, and it only yields access to repositories reachable through the abused token's fallback context - all consistent with the near-zero EPSS and absence of known exploitation.

The signals point to a real but constrained, non-commodity risk. CVSS 4.0 base is 7.2 (High) with total technical impact per CISA SSVC, reflecting the high confidentiality and integrity loss (VC:H/VI:H) from reading and writing private repos. However, SSVC also rates Exploitation as 'none' and Automatable as 'no', and EPSS is negligible at 0.01% (2nd percentile), consistent with an attack that requires authentication (PR:L), an attack requirement/precondition (AT:P), and a fragile chain involving a revocation race and SSH push attribution - i.e., not a spray-and-pray bug. There is no CISA KEV listing and no known POC, so this is not evidence of active exploitation. One point to verify: the vendor scored AV:L, yet the described exploitation (reusing a token against the API/Git endpoints and manipulating installation state) reads as a network-reachable operation, so the local attack-vector choice should be confirmed with GitHub. Net: a genuine authorization-boundary defect worth patching on normal enterprise cadence, but not an emergency zero-day-class issue.

An attacker who already holds a valid low-privilege account and a GitHub App installation on the GHES instance revokes or deletes that installation and, exploiting the revocation-timing window and SSH push attribution, captures a victim-scoped ghu_ token. Because GHES falls back to a global installation context for the now-revoked installation, the attacker replays the token to read and write private repositories outside the intended scope. No public exploit code is identified, and the chain's timing and preconditions (AT:P, AC-high) make it non-trivial to reproduce reliably.