CVE-2026-3306

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3306", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "state": "PUBLISHED", "assignerShortName": "GitHub_P", "dateReserved": "2026-02-26T21:00:40.345Z", "datePublished": "2026-03-10T17:46:57.090Z", "dateUpdated": "2026-03-11T14:17:24.504Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-03-10T17:46:57.090Z"}, "title": "Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "version": "3.14.0", "lessThanOrEqual": "3.14.23", "changes": [{"at": "3.14.24", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.15.0", "lessThanOrEqual": "3.15.18", "changes": [{"at": "3.15.19", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.16.0", "lessThanOrEqual": "3.16.14", "changes": [{"at": "3.16.15", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.17.0", "lessThanOrEqual": "3.17.11", "changes": [{"at": "3.17.12", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.18.0", "lessThanOrEqual": "3.18.5", "changes": [{"at": "3.18.6", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.19.0", "lessThanOrEqual": "3.19.2", "changes": [{"at": "3.19.3", "status": "unaffected"}], "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3.<br>"}]}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24"}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.19"}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6"}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "ahacker1", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:17:15.509272Z", "id": "CVE-2026-3306", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:17:24.504Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "ahacker1"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.14.24", "status": "unaffected"}], "version": "3.14.0", "versionType": "semver", "lessThanOrEqual": "3.14.23"}, {"status": "affected", "changes": [{"at": "3.15.19", "status": "unaffected"}], "version": "3.15.0", "versionType": "semver", "lessThanOrEqual": "3.15.18"}, {"status": "affected", "changes": [{"at": "3.16.15", "status": "unaffected"}], "version": "3.16.0", "versionType": "semver", "lessThanOrEqual": "3.16.14"}, {"status": "affected", "changes": [{"at": "3.17.12", "status": "unaffected"}], "version": "3.17.0", "versionType": "semver", "lessThanOrEqual": "3.17.11"}, {"status": "affected", "changes": [{"at": "3.18.6", "status": "unaffected"}], "version": "3.18.0", "versionType": "semver", "lessThanOrEqual": "3.18.5"}, {"status": "affected", "changes": [{"at": "3.19.3", "status": "unaffected"}], "version": "3.19.0", "versionType": "semver", "lessThanOrEqual": "3.19.2"}], "defaultStatus": "affected"}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24"}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.19"}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6"}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3.", "supportingMedia": [{"type": "text/html", "value": "An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-03-10T17:46:57.090Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3306", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:17:15.509272Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-11T14:17:18.759Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-3306", "state": "PUBLISHED", "dateUpdated": "2026-03-10T17:46:57.090Z", "dateReserved": "2026-02-26T21:00:40.345Z", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "datePublished": "2026-03-10T17:46:57.090Z", "assignerShortName": "GitHub_P"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Enterprise Server", "vendor": "GitHub", "versions": [{"changes": [{"at": "3.14.24", "status": "unaffected"}], "lessThanOrEqual": "3.14.23", "status": "affected", "version": "3.14.0", "versionType": "semver"}, {"changes": [{"at": "3.15.19", "status": "unaffected"}], "lessThanOrEqual": "3.15.18", "status": "affected", "version": "3.15.0", "versionType": "semver"}, {"changes": [{"at": "3.16.15", "status": "unaffected"}], "lessThanOrEqual": "3.16.14", "status": "affected", "version": "3.16.0", "versionType": "semver"}, {"changes": [{"at": "3.17.12", "status": "unaffected"}], "lessThanOrEqual": "3.17.11", "status": "affected", "version": "3.17.0", "versionType": "semver"}, {"changes": [{"at": "3.18.6", "status": "unaffected"}], "lessThanOrEqual": "3.18.5", "status": "affected", "version": "3.18.0", "versionType": "semver"}, {"changes": [{"at": "3.19.3", "status": "unaffected"}], "lessThanOrEqual": "3.19.2", "status": "affected", "version": "3.19.0", "versionType": "semver"}]}], "source": "product-cna@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB7E4D72-FF86-46B4-B083-AF569D3C3113", "versionEndExcluding": "3.14.24", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "F454B367-74E1-49D4-A8C0-BCE14CF453E5", "versionEndExcluding": "3.15.19", "versionStartIncluding": "3.15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC07747C-95D1-4438-BBD8-9BC3C8F6B5F6", "versionEndExcluding": "3.16.15", "versionStartIncluding": "3.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "71BDBBDA-966C-419F-8D4F-5E7FB2411AE8", "versionEndExcluding": "3.17.12", "versionStartIncluding": "3.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "32CB5071-12A8-4C9A-9572-4FBC5C20F869", "versionEndExcluding": "3.18.6", "versionStartIncluding": "3.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7BDDDA3-FE7D-45F6-842C-0D023D926E18", "versionEndExcluding": "3.19.3", "versionStartIncluding": "3.19.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3."}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n impropia fue identificada en GitHub Enterprise Server que permit\u00eda a un usuario con acceso de lectura a un repositorio y acceso de escritura a un proyecto modificar los metadatos de incidencias y solicitudes de extracci\u00f3n a trav\u00e9s del proyecto. Al a\u00f1adir un elemento a un proyecto ya existente, las actualizaciones de los valores de las columnas se aplicaban sin verificar los permisos de escritura del repositorio del actor. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty y ha sido corregida en las versiones de GitHub Enterprise Server 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 y 3.19.3."}], "id": "CVE-2026-3306", "lastModified": "2026-06-17T10:43:22.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "product-cna@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3306", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:17:15.509272Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:19:01.137", "references": [{"source": "product-cna@github.com", "tags": ["Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24"}, {"source": "product-cna@github.com", "tags": ["Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.19"}, {"source": "product-cna@github.com", "tags": ["Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15"}, {"source": "product-cna@github.com", "tags": ["Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12"}, {"source": "product-cna@github.com", "tags": ["Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6"}, {"source": "product-cna@github.com", "tags": ["Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3"}], "sourceIdentifier": "product-cna@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "product-cna@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.14.0,3.14.23]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[3.14.24,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.15.0,3.15.18]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[3.15.19,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.16.0,3.16.14]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[3.16.15,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.17.0,3.17.11]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[3.17.12,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18.0,3.18.5]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[3.18.6,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.19.0,3.19.2]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[3.19.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Enterprise Server", "source": "cna", "vendor": "GitHub"}, "product": "enterprise_server", "vendor": "github"}], "analysis": {"en": {"generated_at": "2026-04-16T03:44:57.410070+00:00", "value": {"mitigation_remediation": ["Upgrade GitHub Enterprise Server to a fixed release (3.14.24 or newer).", "Reconfigure project write permissions so that only users with repository write access can modify project items.", "Enable and review audit logs to detect unauthorized changes to issue or pull request metadata."], "summary": {"action": "Immediate Update", "impact": "Unauthorized modification of issue and pull request metadata"}, "threat_synthesis": {"affected_systems": "GitHub Enterprise Server installations running versions prior to 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 or 3.19.3 are affected. The issue originates from the way project item updation is handled: when a project item is added to an existing project, column value changes are applied without verifying that the actor has repository write rights.", "description_and_impact": "An improper authorization flaw in GitHub Enterprise Server enables users who have only read access to a repository but write access to a project to alter issue and pull request metadata through the project interface. This weakness, identified as CWE\u2011639, allows a user to modify metadata such as labels, assignees, or state of issues and pull requests without possessing repository write permissions. The consequence is a privilege escalation that can tamper with the content and workflow of a repository\u2019s issue tracking system.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 5.3, indicating moderate severity, while the EPSS score is below 1%, suggesting low current exploitation probability. It is not listed in the CISA KEV catalog. The attack requires a user who can add items to a project and read the repository. Once such a user adds an item, the system accepts column value updates without permission checks, enabling tampering with issue and pull request metadata. This permission bypass can be leveraged to manipulate project workflows, potentially compromising confidentiality or integrity of repository data."}}}}, "created": "2026-03-11T11:44:39.914616+00:00", "updated": "2026-04-16T03:45:16.022522+00:00", "vendors": ["github", "github$PRODUCT$enterprise_server"]}