CVE-2026-3582

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3582", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "state": "PUBLISHED", "assignerShortName": "GitHub_P", "dateReserved": "2026-03-05T02:19:50.739Z", "datePublished": "2026-03-10T18:56:56.506Z", "dateUpdated": "2026-03-11T14:13:44.860Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-03-10T18:56:56.506Z"}, "title": "Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "version": "3.16.0", "lessThanOrEqual": "3.16.14", "changes": [{"at": "3.16.15", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.17.0", "lessThanOrEqual": "3.17.11", "changes": [{"at": "3.17.12", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.18.0", "lessThanOrEqual": "3.18.5", "changes": [{"at": "3.18.6", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.19.0", "lessThanOrEqual": "3.19.2", "changes": [{"at": "3.19.3", "status": "unaffected"}], "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program."}]}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6"}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Sergej Ljubojevic", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:13:37.842686Z", "id": "CVE-2026-3582", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:13:44.860Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Sergej Ljubojevic"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.16.15", "status": "unaffected"}], "version": "3.16.0", "versionType": "semver", "lessThanOrEqual": "3.16.14"}, {"status": "affected", "changes": [{"at": "3.17.12", "status": "unaffected"}], "version": "3.17.0", "versionType": "semver", "lessThanOrEqual": "3.17.11"}, {"status": "affected", "changes": [{"at": "3.18.6", "status": "unaffected"}], "version": "3.18.0", "versionType": "semver", "lessThanOrEqual": "3.18.5"}, {"status": "affected", "changes": [{"at": "3.19.3", "status": "unaffected"}], "version": "3.19.0", "versionType": "semver", "lessThanOrEqual": "3.19.2"}], "defaultStatus": "affected"}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6"}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program.", "supportingMedia": [{"type": "text/html", "value": "An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-03-10T18:56:56.506Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3582", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:13:37.842686Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-11T14:13:41.364Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-3582", "state": "PUBLISHED", "dateUpdated": "2026-03-10T18:56:56.506Z", "dateReserved": "2026-03-05T02:19:50.739Z", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "datePublished": "2026-03-10T18:56:56.506Z", "assignerShortName": "GitHub_P"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Enterprise Server", "vendor": "GitHub", "versions": [{"changes": [{"at": "3.16.15", "status": "unaffected"}], "lessThanOrEqual": "3.16.14", "status": "affected", "version": "3.16.0", "versionType": "semver"}, {"changes": [{"at": "3.17.12", "status": "unaffected"}], "lessThanOrEqual": "3.17.11", "status": "affected", "version": "3.17.0", "versionType": "semver"}, {"changes": [{"at": "3.18.6", "status": "unaffected"}], "lessThanOrEqual": "3.18.5", "status": "affected", "version": "3.18.0", "versionType": "semver"}, {"changes": [{"at": "3.19.3", "status": "unaffected"}], "lessThanOrEqual": "3.19.2", "status": "affected", "version": "3.19.0", "versionType": "semver"}]}], "source": "product-cna@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D5AE5C2-BDBC-4E40-A76D-324DA579F6AF", "versionEndExcluding": "3.16.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "71BDBBDA-966C-419F-8D4F-5E7FB2411AE8", "versionEndExcluding": "3.17.12", "versionStartIncluding": "3.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "32CB5071-12A8-4C9A-9572-4FBC5C20F869", "versionEndExcluding": "3.18.6", "versionStartIncluding": "3.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7BDDDA3-FE7D-45F6-842C-0D023D926E18", "versionEndExcluding": "3.19.3", "versionStartIncluding": "3.19.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n incorrecta fue identificada en GitHub Enterprise Server que permit\u00eda a un usuario autenticado con un token de acceso personal (PAT) cl\u00e1sico que carec\u00eda del alcance 'repo' recuperar incidencias y commits de repositorios privados e internos a trav\u00e9s de los puntos finales de la API REST de b\u00fasqueda. El usuario deb\u00eda tener acceso existente al repositorio a trav\u00e9s de la membres\u00eda de la organizaci\u00f3n o como colaborador para que la vulnerabilidad fuera explotable. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.20 y fue corregida en las versiones 3.16.15, 3.17.12, 3.18.6 y 3.19.3. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty."}], "id": "CVE-2026-3582", "lastModified": "2026-06-17T10:43:49.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "product-cna@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3582", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:13:37.842686Z", "version": "2.0.3"}}]}, "published": "2026-03-10T20:16:41.373", "references": [{"source": "product-cna@github.com", "tags": ["Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15"}, {"source": "product-cna@github.com", "tags": ["Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12"}, {"source": "product-cna@github.com", "tags": ["Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6"}, {"source": "product-cna@github.com", "tags": ["Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3"}], "sourceIdentifier": "product-cna@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "product-cna@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.16.0,3.16.14]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.17.0,3.17.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18.0,3.18.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.19.0,3.19.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Enterprise Server", "source": "cna", "vendor": "GitHub"}, "product": "enterprise_server", "vendor": "github"}], "analysis": {"en": {"generated_at": "2026-04-16T03:31:19.484323+00:00", "value": {"mitigation_remediation": ["Upgrade GitHub Enterprise Server to at least version 3.16.15, 3.17.12, 3.18.6, or 3.19.3 depending on your current release trajectory, ensuring the authorization fix is applied. ", "If your environment cannot be updated immediately, audit and revoke any classic personal access tokens that lack the repo scope, and require new tokens with the appropriate scopes for accessing repository data. ", "Limit search API usage for users who do not need to inspect private or internal repositories until the server is patched; consider disabling the search endpoint for non\u2011essential accounts or applying ACLs to restrict search results to authorized repositories."], "summary": {"action": "Apply patch", "impact": "Unauthorized access to private and internal repository search results"}, "threat_synthesis": {"affected_systems": "GitHub Enterprise Server was affected in all releases prior to 3.20. The vulnerability was fixed in version 3.16.15, 3.17.12, 3.18.6, and 3.19.3, so any installation running an earlier version is at risk and must be updated. The fix eliminates the ability for a non\u2011repo\u2011scoped token to return search results from private or internal repositories that the user has access to via organization membership or collaboration.", "description_and_impact": "An Incorrect Authorization flaw in GitHub Enterprise Server allows a user authenticated with a classic personal access token that lacks the repo scope to retrieve issues and commits from private and internal repositories through the search REST API endpoints. The weakness, identified as CWE-862, enables the attacker to read repository data that should be restricted, potentially exposing sensitive information, code, and issue histories. The impact is a moderation-level breach of confidentiality but does not provide code execution or persistence capabilities.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate risk, and the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, further supporting a low imminent threat profile. However, to exploit the weakness a user must already possess repository access, which can mean a legitimate member or collaborator. Once authenticated, they can query the API and receive data that should require repo privileges, meaning that any compromised or malicious account with broad organization membership could surreptitiously harvest internal code and issue information. The attack vector is authenticated remote API use, inferred from the description; no local privilege escalation or code execution is required."}}}}, "created": "2026-03-11T11:43:30.448506+00:00", "updated": "2026-04-16T03:45:16.011478+00:00", "vendors": ["github", "github$PRODUCT$enterprise_server"]}