6.5

CVE-2026-75101

Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to the repository name and pull request number rather than to a globally unique repository identifier, so an attacker who created a repository and pull request matching a target's repository name and pull request number could use a token for their own repository to retrieve the private pull request's contents. Exploitation required the attacker to know the target repository's name and a valid pull request number. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. This vulnerability was reported via the GitHub Bug Bounty program.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Github ≫ Enterprise Server Version >= 3.17.0 < 3.17.21
Github ≫ Enterprise Server Version >= 3.18.0 < 3.18.15
Github ≫ Enterprise Server Version >= 3.19.0 < 3.19.12
Github ≫ Enterprise Server Version >= 3.20.0 < 3.20.8
Github ≫ Enterprise Server Version >= 3.21.0 < 3.21.6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.45% 0.384
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
product-cna@github.com 6 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.21
Vendor Advisory
Release Notes
https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.15
Vendor Advisory
Release Notes
https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.12
Vendor Advisory
Release Notes
https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.8
Vendor Advisory
Release Notes
https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.6
Vendor Advisory
Release Notes