CVE-2026-1355

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1355", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "state": "PUBLISHED", "assignerShortName": "GitHub_P", "dateReserved": "2026-01-22T19:14:46.710Z", "datePublished": "2026-02-18T20:42:07.180Z", "dateUpdated": "2026-02-20T19:36:28.885Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Enterprise Server", "vendor": "GitHub", "versions": [{"changes": [{"at": "3.19.2", "status": "unaffected"}], "lessThanOrEqual": "3.19.1", "status": "affected", "version": "3.19.0", "versionType": "semver"}, {"changes": [{"at": "3.18.5", "status": "unaffected"}], "lessThanOrEqual": "3.18.4", "status": "affected", "version": "3.18.0", "versionType": "semver"}, {"changes": [{"at": "3.17.11", "status": "unaffected"}], "lessThanOrEqual": "3.17.10", "status": "affected", "version": "3.17.0", "versionType": "semver"}, {"changes": [{"at": "3.16.14", "status": "unaffected"}], "lessThanOrEqual": "3.16.13", "status": "affected", "version": "3.16.0", "versionType": "semver"}, {"changes": [{"at": "3.15.18", "status": "unaffected"}], "lessThanOrEqual": "3.15.17", "status": "affected", "version": "3.15.0", "versionType": "semver"}, {"changes": [{"at": "3.14.23", "status": "unaffected"}], "lessThanOrEqual": "3.14.22", "status": "affected", "version": "3.14.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "ahacker1"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user\u2019s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim\u2019s migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23. This vulnerability was reported via the GitHub Bug Bounty program.<br><br>"}], "value": "A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user\u2019s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim\u2019s migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23. This vulnerability was reported via the GitHub Bug Bounty program."}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:L", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-02-18T20:42:07.180Z"}, "references": [{"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.5"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.11"}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.14"}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.18"}, {"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.23"}], "source": {"discovery": "UNKNOWN"}, "title": "Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T19:36:17.574271Z", "id": "CVE-2026-1355", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T19:36:28.885Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1355", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T19:36:17.574271Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T19:36:22.331Z"}}], "cna": {"title": "Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "ahacker1"}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.19.2", "status": "unaffected"}], "version": "3.19.0", "versionType": "semver", "lessThanOrEqual": "3.19.1"}, {"status": "affected", "changes": [{"at": "3.18.5", "status": "unaffected"}], "version": "3.18.0", "versionType": "semver", "lessThanOrEqual": "3.18.4"}, {"status": "affected", "changes": [{"at": "3.17.11", "status": "unaffected"}], "version": "3.17.0", "versionType": "semver", "lessThanOrEqual": "3.17.10"}, {"status": "affected", "changes": [{"at": "3.16.14", "status": "unaffected"}], "version": "3.16.0", "versionType": "semver", "lessThanOrEqual": "3.16.13"}, {"status": "affected", "changes": [{"at": "3.15.18", "status": "unaffected"}], "version": "3.15.0", "versionType": "semver", "lessThanOrEqual": "3.15.17"}, {"status": "affected", "changes": [{"at": "3.14.23", "status": "unaffected"}], "version": "3.14.0", "versionType": "semver", "lessThanOrEqual": "3.14.22"}], "defaultStatus": "affected"}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.5"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.11"}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.14"}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.18"}, {"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.23"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user\u2019s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim\u2019s migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23. This vulnerability was reported via the GitHub Bug Bounty program.", "supportingMedia": [{"type": "text/html", "value": "A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user\u2019s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim\u2019s migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23. This vulnerability was reported via the GitHub Bug Bounty program.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-02-18T20:42:07.180Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1355", "state": "PUBLISHED", "dateUpdated": "2026-02-20T19:36:28.885Z", "dateReserved": "2026-01-22T19:14:46.710Z", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "datePublished": "2026-02-18T20:42:07.180Z", "assignerShortName": "GitHub_P"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Enterprise Server", "vendor": "GitHub", "versions": [{"changes": [{"at": "3.19.2", "status": "unaffected"}], "lessThanOrEqual": "3.19.1", "status": "affected", "version": "3.19.0", "versionType": "semver"}, {"changes": [{"at": "3.18.5", "status": "unaffected"}], "lessThanOrEqual": "3.18.4", "status": "affected", "version": "3.18.0", "versionType": "semver"}, {"changes": [{"at": "3.17.11", "status": "unaffected"}], "lessThanOrEqual": "3.17.10", "status": "affected", "version": "3.17.0", "versionType": "semver"}, {"changes": [{"at": "3.16.14", "status": "unaffected"}], "lessThanOrEqual": "3.16.13", "status": "affected", "version": "3.16.0", "versionType": "semver"}, {"changes": [{"at": "3.15.18", "status": "unaffected"}], "lessThanOrEqual": "3.15.17", "status": "affected", "version": "3.15.0", "versionType": "semver"}, {"changes": [{"at": "3.14.23", "status": "unaffected"}], "lessThanOrEqual": "3.14.22", "status": "affected", "version": "3.14.0", "versionType": "semver"}]}], "source": "product-cna@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "BEA55C32-050E-43E6-A333-DAB8081BEA39", "versionEndExcluding": "3.14.23", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED4B65C8-B789-4241-B6A8-7DEA48362FE5", "versionEndExcluding": "3.15.18", "versionStartIncluding": "3.15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "46E1F973-5D32-4EB4-ABF0-758153BE97BD", "versionEndExcluding": "3.16.14", "versionStartIncluding": "3.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "90147B72-EECF-4EB8-82D2-A3F98D0223A9", "versionEndExcluding": "3.17.11", "versionStartIncluding": "3.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7172422-332C-4454-85A3-551BBAC1A59C", "versionEndExcluding": "3.18.5", "versionStartIncluding": "3.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8AE9F21-7596-446E-99B8-F09A230F173A", "versionEndExcluding": "3.19.2", "versionStartIncluding": "3.19.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user\u2019s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim\u2019s migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad de falta de autorizaci\u00f3n en GitHub Enterprise Server que permit\u00eda a un atacante cargar contenido no autorizado a la exportaci\u00f3n de migraci\u00f3n de repositorio de otro usuario debido a una falta de verificaci\u00f3n de autorizaci\u00f3n en el endpoint de carga de migraci\u00f3n de repositorio. Al proporcionar el identificador de migraci\u00f3n, un atacante podr\u00eda sobrescribir o reemplazar el archivo de migraci\u00f3n de una v\u00edctima, lo que podr\u00eda hacer que las v\u00edctimas descargaran datos de repositorio controlados por el atacante durante las restauraciones de migraci\u00f3n o importaciones automatizadas. Un atacante requerir\u00eda autenticaci\u00f3n a la instancia de GitHub Enterprise Server de la v\u00edctima. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.20 y fue corregida en las versiones 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty."}], "id": "CVE-2026-1355", "lastModified": "2026-06-17T10:15:39.027", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "product-cna@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1355", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T19:36:17.574271Z", "version": "2.0.3"}}]}, "published": "2026-02-18T21:16:23.460", "references": [{"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.23"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.18"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.14"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.11"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.5"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2"}], "sourceIdentifier": "product-cna@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "product-cna@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.19.0,3.19.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18.0,3.18.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.17.0,3.17.10]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.16.0,3.16.13]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.15.0,3.15.17]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.14.0,3.14.22]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Enterprise Server", "source": "cna", "vendor": "GitHub"}, "product": "enterprise_server", "vendor": "github"}], "analysis": {"en": {"generated_at": "2026-04-17T18:29:28.352677+00:00", "value": {"mitigation_remediation": ["Upgrade the GitHub Enterprise Server to version 3.19.2 or later, with the latest patch containing the fix.", "If upgrading cannot be performed immediately, restrict or disable the repository migration upload endpoint for all users except administrators until the patch is applied.", "After applying the patch, audit existing migration archives to detect and remove any unauthorized or attacker\u2011controlled uploads."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized data upload in repository migrations"}, "threat_synthesis": {"affected_systems": "The flaw affects GitHub Enterprise Server installations running any version prior to 3.20. Security updates for this issue were released in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, and 3.14.23.", "description_and_impact": "A missing authorization check in the repository migration upload endpoint allowed an authenticated attacker to overwrite or replace a victim\u2019s migration archive. By supplying the migration identifier, the attacker could cause victims to download attacker\u2011controlled data during migration restores or automated imports. The vulnerability can compromise the integrity of repository data and potentially introduce malicious content into a repository. The impact is strictly limited to users who can authenticate to the victim\u2019s GitHub Enterprise Server instance.", "risk_and_exploitability": "The CVSS score of 6.0 indicates a moderate severity vulnerability. EPSS is below 1\u202f%, suggesting a low likelihood of exploitation at present, and the issue is not listed in the CISA KEV catalog. Attackers must be able to authenticate to the GitHub Enterprise Server instance, after which they can upload to a migration export, leading to unauthorized data modification. The missing authorization check (CWE\u2011862) lies at the core of the issue."}}}}, "created": "2026-02-19T10:11:17.819829+00:00", "updated": "2026-04-17T18:30:05.662792+00:00", "vendors": ["github", "github$PRODUCT$enterprise_server"]}