GitHub Enterprise Server EUVD-2026-116582

Exploitation requires two concrete preconditions stated in the description: (1) the GitHub Enterprise Server instance must have Slack and/or Microsoft Teams ChatOps integrations configured, and (2) an authenticated Management Console operator must visit attacker-controlled content while signed in to the Management Console, so that their browser issues the tokenless cross-site GET to the integration removal endpoint. Limiting factors: the attack needs that operator's active, authenticated session plus user interaction (UI:P), and it only takes effect - disrupting ChatOps notifications and commands - when configuration is applied or services are reloaded. If ChatOps integrations are not configured, there is nothing to delete. The impact is restricted to deletion of ChatOps configuration/provider credentials (integrity/availability), with no confidentiality exposure.

This is a medium-severity CSRF flaw (CWE-352, vendor CVSS 4.0 base 5.3) whose real-world priority is moderate rather than urgent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L) shows a network-reachable, low-complexity issue that needs no attacker privileges, but it is gated by passive user interaction (UI:P) and causes only limited integrity and availability impact with no confidentiality loss (VC:N) - consistent with an attacker who can delete ChatOps configuration/credentials but cannot read data or take over the system. There is no CISA KEV listing and no EPSS score is present in the input, so there is no signal of active or probable exploitation; no public exploit or PoC reference is provided either. The vuln.today decision label is 'this_month', which aligns with the medium technical impact and the non-trivial preconditions (configured ChatOps integrations plus a logged-in Management Console operator who must visit attacker content). Net: a legitimate issue to remediate in the normal monthly patch cycle, not an emergency; the biggest caveat is that exploitation depends on an operator's session and browser behavior, which the raw 'unauthenticated/AV:N' labeling can overstate if read in isolation.

An attacker crafts a web page containing a cross-site GET request (e.g., an embedded resource) targeting the ChatOps integration removal endpoint and lures a GitHub Enterprise Server Management Console operator to visit it while that operator is signed in. Because the removal endpoint accepts the request without a CSRF token, the operator's browser silently deletes the configured Slack and Microsoft Teams ChatOps configuration and stored provider credentials. No public exploit identified at time of analysis; exploitation requires the operator interaction and complexity reflected in UI:P.