Which versions of GitHub Enterprise Server are affected by EUVD-2026-24552?

A privilege escalation vulnerability in GitHub Enterprise Server prior to version 3.21 allows authenticated users with scoped GitHub App tokens to bypass intended access controls and reach private…. A patch is available.

How to fix or mitigate EUVD-2026-24552?

Within 24 hours, inventory all GitHub App installations using scoped user-to-server (ghu_) tokens and identify private repositories within your GHES instance; disable or rotate tokens from any untrusted or unused GitHub Apps as a precautionary measure. Within 7 days, apply the vendor-released patch by upgrading GitHub Enterprise Server to version 3.21 or later on all instances; this requires scheduling downtime and performing a full cluster update if using high availability. Within 30 days, audit repository access logs for any suspicious push activity attributed to scoped tokens, revoke tokens from applications no longer in use, and implement tighter scope restrictions on new GitHub App authorizations to prevent similar bypasses.

GitHub Enterprise Server EUVD-2026-24552

Q: What is the CVSS score of EUVD-2026-24552?

EUVD-2026-24552 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5845 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-21 product-cna@github.com

GHSA-29qm-pmxx-2p86

Authentication Bypass Enterprise Server

7.2

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Authenticated attacker (PR:L) exploits a token-revocation race and SSH attribution (AC:H) over network endpoints (AV:N); crossing installation scope is a scope change (S:C) with high confidentiality/integrity but no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:21 vuln.today

Patch released

Apr 29, 2026 - 12:30 nvd

Patch available

Apr 22, 2026 - 02:01 EUVD

EUVD ID Assigned

Apr 21, 2026 - 23:22 euvd

EUVD-2026-24552

CVE Published

Apr 21, 2026 - 23:16 nvd

HIGH 7.2

DescriptionGitHub Advisory

An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context, which could be chained with token revocation timing and SSH push attribution to obtain and reuse a victim-scoped token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

AnalysisAI

Improper authorization in GitHub Enterprise Server (GHES) lets an authenticated attacker abuse scoped user-to-server (ghu_) tokens to reach private repositories outside their intended GitHub App installation scope, including write access. The root cause is an authorization fallback that treated a revoked or deleted installation as a global installation context; chained with token-revocation timing and SSH push attribution, an attacker can obtain and reuse a victim-scoped token. It affects all GHES releases prior to 3.21 and was reported through the GitHub Bug Bounty program, with no public exploit identified at time of analysis.

Technical ContextAI

GitHub Apps issue scoped user-to-server tokens (prefixed ghu_) whose authority is bounded by a specific App installation, which in turn defines which repositories and permissions the token may exercise. This flaw is a CWE-639 (Authorization Bypass Through User-Controlled Key / improper authorization) defect in how GHES resolves the installation context for such tokens: when an installation was revoked or deleted, the authorization logic fell back to treating the request as a global installation context rather than denying it, effectively removing the per-installation repository boundary. The exploit also leverages the timing window around token revocation and how Git-over-SSH push operations attribute actions, allowing a victim-scoped token to be captured and replayed against private repositories the attacker should not reach. The CPE data confirms the affected component is github:enterprise_server (self-hosted GHES), with 3.20.0 explicitly enumerated and all prior 3.14-3.20 branches implicated.

RemediationAI

Vendor-released patch: upgrade to the fixed build on your release branch - 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, or 3.14.26 (any release 3.21 or later is also fixed) - per the GitHub Enterprise Server admin release notes (e.g. https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1). Because this is a server-side authorization defect in GHES itself, no client-side configuration change fully mitigates it, so patching is the primary and effectively required control. As interim compensating measures on unpatched instances, consider revoking and rotating GitHub App installation credentials and user-to-server (ghu_) tokens to shrink the pool of reusable victim tokens, auditing GitHub App installation deletion/revocation events and unexpected cross-repository access, and tightening who can install or manage GitHub Apps to limit the authenticated foothold the attack requires; note these steps reduce exposure and aid detection but do not eliminate the underlying fallback flaw, and credential rotation may temporarily disrupt automation that relies on those tokens.