GitHub Enterprise Server EUVD-2026-24550

Exploitation requires a valid authenticated account on the target GitHub Enterprise Server instance (CVSS PR:L). No elevated privileges, administrative access, or special repository permissions are needed - any low-privileged user credential suffices. The mobile upload policy API endpoint must be reachable from the attacker's network position (AV:N). No special server-side configuration, non-default feature flag, or specific deployment mode is required; the vulnerable code path is present in all unpatched instances by default. Exploitation is limited to disclosure of private repository names only - repository contents, commits, secrets, access controls, and credentials are not exposed. The SSVC 'Automatable: no' rating suggests that while scripting is technically feasible, automated mass exploitation at scale is not trivially achieved.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L) scores 5.3, reflecting a low-complexity network-accessible flaw with no availability or integrity impact to the vulnerable system, and only partial confidentiality exposure. EPSS at 0.05% (15th percentile) is very low, consistent with SSVC's 'Exploitation: none' and 'Automatable: no' ratings. The SSVC 'Technical Impact: partial' confirms the narrow scope - only repository names leak, not contents, credentials, or keys. No entry in CISA KEV and no public POC identified. Despite the low severity score, the real-world concern is contextual: in regulated industries or competitive environments, private repository names alone may reveal sensitive product roadmaps, acquisition targets, or internal project codenames. For most deployments, the risk is low-priority relative to higher-severity findings, but enterprises with particularly sensitive naming conventions should treat this as a moderate informational risk.

An authenticated attacker with any valid account on a GitHub Enterprise Server instance systematically iterates numeric repository IDs against the mobile upload policy API endpoint. For each ID corresponding to a private repository the attacker cannot access, the API returns a validation error message containing the full repository name, allowing the attacker to build a list of private repository names across the instance without ever reading repository contents. No public exploit code has been identified.