GitHub Enterprise Server EUVD-2026-84874

Requires a valid authenticated account on the GitHub Enterprise Server instance (PR:L), plus knowledge of the target private repository's name and a valid pull request number within it - the raw diff/patch access token is scoped only to repository name and PR number rather than a globally unique repository identifier, so the attacker forges a repo and PR with matching name/number to mint a usable token. Limiting factors: the attacker must already be an instance user, must be able to create repositories/PRs, and must know or guess the exact target repo name and a valid PR number (the AT:P attack requirement). Impact is confined to reading private PR diffs/patches - no write or availability effect. Affects all GHES versions before 3.22; fixed in 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6.

This is a real but moderate-priority authorization/IDOR issue (CWE-639), consistent with its vendor CVSS 4.0 score of 6.0 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N). The confidentiality impact is genuinely high (VC:H) - an attacker retrieves the full raw diff/patch of private pull requests - but several factors constrain real-world severity: exploitation requires an authenticated instance user (PR:L), and the AT:P attack-requirement flag reflects the concrete prerequisite that the attacker must know the target repository's name AND a valid pull request number to forge a matching repo/PR. No EPSS score, KEV listing, or public POC was provided in the input; the flaw was responsibly disclosed via the GitHub Bug Bounty program (reporter GitHub_P), which points to no in-the-wild exploitation. There is no integrity or availability impact (VI:N/VA:N), so this is a pure information-disclosure bug affecting private source code. The one metric worth verifying: the 'Authentication Bypass' tag overstates the issue - this is authorization bypass by an already-authenticated user, not an authentication bypass, and CWE-639 (authorization) confirms that framing.

An authenticated user on a GitHub Enterprise Server instance who wants a competitor team's private code learns a target private repository's name and a plausible pull request number. They create their own repository and pull request using the same repository name and PR number, obtain the raw-diff/patch access token scoped only to that name+number, and replay it to fetch the private PR's diff. No public exploit code is identified at time of analysis; the flaw was reported through the GitHub Bug Bounty program.