EUVD-2026-40407
GHSA-gfj9-8v3r-jh2q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects the need for a GHES account to register an OAuth app; UI:R for mandatory victim authorization; S:C because the token crosses into the victim organization's runner management scope.
Primary rating from Vendor (GitHub_P).
CVSS VectorVendor: GitHub_P
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
AnalysisAI
OAuth scope concealment in GitHub Enterprise Server allows an attacker to obtain unauthorized control over an organization's GitHub Actions runner management by exploiting a missing scope disclosure on the authorization consent screen. The manage_runners:org OAuth scope, which governs CI/CD runner infrastructure, is never shown to the victim during the standard OAuth authorization flow, enabling a maliciously crafted OAuth application to acquire it without informed user consent. No public exploit or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 4.8 and mandatory user interaction (UI:A) correctly reflect the social-engineering dependency that constrains real-world exploitation.
Technical ContextAI
GitHub Enterprise Server (CPE: cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*) implements an OAuth 2.0 authorization flow that presents a consent screen enumerating the scopes an application is requesting. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: the manage_runners:org scope - which grants programmatic control over self-hosted runners used to execute GitHub Actions CI/CD pipelines - was omitted from the consent screen display entirely. This is a frontend disclosure failure, not a backend access control failure; the scope is validly issued by the server but hidden from the user during the authorization decision point. Runners in GitHub Enterprise Server are privileged infrastructure components that execute code in the organization's environment, making unauthorized runner management a potential vector for supply chain interference or secret exfiltration during pipeline execution.
RemediationAI
Upgrade GitHub Enterprise Server to the earliest patched release available for your current minor version: 3.16.x → 3.16.20, 3.17.x → 3.17.17, 3.18.x → 3.18.11, 3.19.x → 3.19.8, 3.20.x → 3.20.4, or 3.21.x → 3.21.2, with version-specific release notes at the GitHub docs references provided. If an immediate upgrade is not feasible, a compensating control is to audit all currently authorized OAuth applications within your organizations and revoke any that hold the manage_runners:org scope that were not explicitly reviewed and approved by an administrator - this eliminates any scope already silently granted. Additionally, restricting which users are permitted to authorize third-party OAuth applications via organization OAuth app policies (Settings → Organization → Third-party access) reduces the attack surface by limiting who can be targeted. Note that these controls address exposure but do not close the underlying UI disclosure gap; patching remains the authoritative fix.
More in Enterprise Server
View allThe RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. R
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe
An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sig
An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Ent
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL
An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server
An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication wi
Server-side request forgery in GitHub Enterprise Server lets an unauthenticated attacker coerce the appliance into issui
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today