CVE-2026-3307

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3307", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "state": "PUBLISHED", "assignerShortName": "GitHub_P", "dateReserved": "2026-02-26T21:00:43.352Z", "datePublished": "2026-04-21T22:23:25.045Z", "dateUpdated": "2026-04-22T18:00:21.619Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-04-21T22:23:25.045Z"}, "title": "Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-58", "descriptions": [{"lang": "en", "value": "CAPEC-58 Restful Privilege Elevation"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "version": "3.14.0", "lessThanOrEqual": "3.14.24", "changes": [{"at": "3.14.25", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.15.0", "lessThanOrEqual": "3.15.19", "changes": [{"at": "3.15.20", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.16.0", "lessThanOrEqual": "3.16.15", "changes": [{"at": "3.16.16", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.17.0", "lessThanOrEqual": "3.17.12", "changes": [{"at": "3.17.13", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.18.0", "lessThanOrEqual": "3.18.6", "changes": [{"at": "3.18.7", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.19.0", "lessThanOrEqual": "3.19.3", "changes": [{"at": "3.19.4", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.20", "lessThanOrEqual": "3.20.0", "changes": [{"at": "3.20.1", "status": "unaffected"}], "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the owner_id parameter in the request body. Authorization was verified against the repository in the URL, but the action was applied to a different repository specified in the request body. The impact is limited to assigning existing trusted users as bypass reviewers; it does not allow adding arbitrary external users. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the owner_id parameter in the request body. Authorization was verified against the repository in the URL, but the action was applied to a different repository specified in the request body. The impact is limited to assigning existing trusted users as bypass reviewers; it does not allow adding arbitrary external users. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program.<br>"}]}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.25"}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.20"}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.16"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.13"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.7"}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.4"}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "ahacker1", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T17:59:58.981543Z", "id": "CVE-2026-3307", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:00:21.619Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3307", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T17:59:58.981543Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:00:06.023Z"}}], "cna": {"title": "Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "ahacker1"}], "impacts": [{"capecId": "CAPEC-58", "descriptions": [{"lang": "en", "value": "CAPEC-58 Restful Privilege Elevation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.14.25", "status": "unaffected"}], "version": "3.14.0", "versionType": "semver", "lessThanOrEqual": "3.14.24"}, {"status": "affected", "changes": [{"at": "3.15.20", "status": "unaffected"}], "version": "3.15.0", "versionType": "semver", "lessThanOrEqual": "3.15.19"}, {"status": "affected", "changes": [{"at": "3.16.16", "status": "unaffected"}], "version": "3.16.0", "versionType": "semver", "lessThanOrEqual": "3.16.15"}, {"status": "affected", "changes": [{"at": "3.17.13", "status": "unaffected"}], "version": "3.17.0", "versionType": "semver", "lessThanOrEqual": "3.17.12"}, {"status": "affected", "changes": [{"at": "3.18.7", "status": "unaffected"}], "version": "3.18.0", "versionType": "semver", "lessThanOrEqual": "3.18.6"}, {"status": "affected", "changes": [{"at": "3.19.4", "status": "unaffected"}], "version": "3.19.0", "versionType": "semver", "lessThanOrEqual": "3.19.3"}, {"status": "affected", "changes": [{"at": "3.20.1", "status": "unaffected"}], "version": "3.20", "versionType": "semver", "lessThanOrEqual": "3.20.0"}], "defaultStatus": "affected"}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.25"}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.20"}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.16"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.13"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.7"}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.4"}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the owner_id parameter in the request body. Authorization was verified against the repository in the URL, but the action was applied to a different repository specified in the request body. The impact is limited to assigning existing trusted users as bypass reviewers; it does not allow adding arbitrary external users. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program.", "supportingMedia": [{"type": "text/html", "value": "An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the owner_id parameter in the request body. Authorization was verified against the repository in the URL, but the action was applied to a different repository specified in the request body. The impact is limited to assigning existing trusted users as bypass reviewers; it does not allow adding arbitrary external users. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-04-21T22:23:25.045Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3307", "state": "PUBLISHED", "dateUpdated": "2026-04-22T18:00:21.619Z", "dateReserved": "2026-02-26T21:00:43.352Z", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "datePublished": "2026-04-21T22:23:25.045Z", "assignerShortName": "GitHub_P"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Enterprise Server", "vendor": "GitHub", "versions": [{"changes": [{"at": "3.14.25", "status": "unaffected"}], "lessThanOrEqual": "3.14.24", "status": "affected", "version": "3.14.0", "versionType": "semver"}, {"changes": [{"at": "3.15.20", "status": "unaffected"}], "lessThanOrEqual": "3.15.19", "status": "affected", "version": "3.15.0", "versionType": "semver"}, {"changes": [{"at": "3.16.16", "status": "unaffected"}], "lessThanOrEqual": "3.16.15", "status": "affected", "version": "3.16.0", "versionType": "semver"}, {"changes": [{"at": "3.17.13", "status": "unaffected"}], "lessThanOrEqual": "3.17.12", "status": "affected", "version": "3.17.0", "versionType": "semver"}, {"changes": [{"at": "3.18.7", "status": "unaffected"}], "lessThanOrEqual": "3.18.6", "status": "affected", "version": "3.18.0", "versionType": "semver"}, {"changes": [{"at": "3.19.4", "status": "unaffected"}], "lessThanOrEqual": "3.19.3", "status": "affected", "version": "3.19.0", "versionType": "semver"}, {"changes": [{"at": "3.20.1", "status": "unaffected"}], "lessThanOrEqual": "3.20.0", "status": "affected", "version": "3.20", "versionType": "semver"}]}], "source": "product-cna@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "72A92258-9FCC-41E0-856B-3C2A495575A6", "versionEndExcluding": "3.14.26", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "3A14A459-881C-437A-88EC-D721E3005329", "versionEndExcluding": "3.15.21", "versionStartIncluding": "3.15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B7DCD9A-2CF0-4D96-AA96-ACEC662A8E1F", "versionEndExcluding": "3.16.17", "versionStartIncluding": "3.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "CEC2ADE6-3E31-4889-9A73-B6695FE0AB52", "versionEndExcluding": "3.17.14", "versionStartIncluding": "3.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B15B12E-00A8-48E8-81DE-54506B94A2C5", "versionEndExcluding": "3.18.8", "versionStartIncluding": "3.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "56903EAF-4579-4263-AB0F-863323E7C81A", "versionEndExcluding": "3.19.5", "versionStartIncluding": "3.19.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:3.20.0:*:*:*:*:*:*:*", "matchCriteriaId": "DCA4F97D-688E-45D2-90C0-8A11E9B531AA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the owner_id parameter in the request body. Authorization was verified against the repository in the URL, but the action was applied to a different repository specified in the request body. The impact is limited to assigning existing trusted users as bypass reviewers; it does not allow adding arbitrary external users. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n fue identificada en GitHub Enterprise Server que permit\u00eda a un atacante con acceso de administrador en un repositorio modificar la lista de revisores de omisi\u00f3n delegada de la protecci\u00f3n de inserci\u00f3n de escaneo de secretos en otro repositorio manipulando el par\u00e1metro owner_id en el cuerpo de la solicitud. La autorizaci\u00f3n fue verificada contra el repositorio en la URL, pero la acci\u00f3n fue aplicada a un repositorio diferente especificado en el cuerpo de la solicitud. El impacto se limita a asignar usuarios de confianza existentes como revisores de omisi\u00f3n; no permite a\u00f1adir usuarios externos arbitrarios. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y fue corregida en las versiones 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 y 3.20.1. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty."}], "id": "CVE-2026-3307", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "product-cna@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3307", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T17:59:58.981543Z", "version": "2.0.3"}}]}, "published": "2026-04-21T23:16:19.950", "references": [{"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.25"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.20"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.16"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.13"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.7"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.4"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1"}], "sourceIdentifier": "product-cna@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "product-cna@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.14.0,3.14.24]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.14.25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.15.0,3.15.19]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.15.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.16.0,3.16.15]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.16.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.17.0,3.17.12]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.17.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18.0,3.18.6]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.18.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.19.0,3.19.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.19.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.20,3.20.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.20.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Enterprise Server", "source": "cna", "vendor": "GitHub"}, "product": "enterprise_server", "vendor": "github"}], "analysis": {"en": {"generated_at": "2026-04-22T04:28:45.960471+00:00", "value": {"mitigation_remediation": ["Upgrade the Enterprise Server to a patched version\u2014version 3.21 or later, or any of the releases that contain the fix (3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, or 3.20.1).", "Limit administrative access to repositories that manage secret scanning push protection; ensure only trusted users are granted such privileges.", "Monitor API activity and review logs for unauthorized changes to the bypass reviewer list, and audit configuration changes to detect potential abuse of this bypass."], "summary": {"action": "Apply Patch", "impact": "Authorization bypass allowing cross\u2011repository modification of delegated bypass reviewers"}, "threat_synthesis": {"affected_systems": "GitHub Enterprise Server versions released before 3.21 are affected. The vulnerability was patched in releases 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, and 3.20.1. All earlier versions should be upgraded to a party that includes the fix.", "description_and_impact": "An attacker who already has admin rights on one GitHub Enterprise Server repository can alter the secret\u2011scanning push protection delegated bypass reviewer list on a different repository by sending a request that changes the owner_id parameter in the request body. This achieves an authorization bypass that lets the attacker assign existing trusted users as bypass reviewers on the target repository. The flaw does not allow the addition of arbitrary external users, so the impact is limited to re\u2011assigning trusted reviewers rather than providing arbitrary access.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. An attacker would need to target a repository where they already possess admin privileges and craft a request that manipulates the owner_id field, so the attack vector is internal privilege escalation within the organization's own GitHub Enterprise Server instance."}}}}, "created": "2026-04-22T02:15:05.236303+00:00", "updated": "2026-04-22T04:30:05.308697+00:00", "vendors": ["github", "github$PRODUCT$enterprise_server"]}