CVE-2026-14340
published 2026-07-01CVE-2026-14340: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to…
PriorityP431medium5CVSS 3.1
AVNACLPRLUINSCCNILAN
EPSS
0.43%
36.6th percentile
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. This was possible because the authorization check only verified that the installation had read permissions on the target repository rather than verifying that the token's installation was explicitly granted access to that repository. An attacker who obtained a victim's user-to-server token could create issues, issue comments, commit comments, and private vulnerability reports on any public repository, appearing as the victim user with no indication of the app involvement. This vulnerability was fixed by adding a repository scope check for user-to-server tokens issued by global apps. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github | enterprise_server | < 3.16.20 | 3.16.20 |
| github | enterprise_server | 3.16.0 – 3.16.19 | — |
| github | enterprise_server | >= 3.17.0 < 3.17.17 | 3.17.17 |
| github | enterprise_server | 3.17.0 – 3.17.16 | — |
| github | enterprise_server | >= 3.18.0 < 3.18.11 | 3.18.11 |
| github | enterprise_server | 3.18.0 – 3.18.10 | — |
| github | enterprise_server | >= 3.19.0 < 3.19.8 | 3.19.8 |
| github | enterprise_server | 3.19.0 – 3.19.7 | — |
| github | enterprise_server | >= 3.20.0 < 3.20.4 | 3.20.4 |
| github | enterprise_server | 3.20.0 – 3.20.3 | — |
| github | enterprise_server | >= 3.21.0 < 3.21.2 | 3.21.2 |
| github | enterprise_server | 3.21.0 – 3.21.1 | — |
CVSS provenance
nvdv3.15.0MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GitHub Enterprise Server up to 3.21.1 authorization
vuldb·2026-07-02·CVSS 5.3
CVE-2026-14340 [MEDIUM] GitHub Enterprise Server up to 3.21.1 authorization
A vulnerability, which was classified as problematic, has been found in GitHub Enterprise Server up to 3.21.1. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in incorrect authorization.
This vulnerability is known as CVE-2026-14340. Remote exploitation of the attack is possible. No exploit is available.
It is advisable to upgrade the affected component.
GHSA
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on publi
ghsa_unreviewed·2026-07-01
CVE-2026-14340 [MEDIUM] CWE-863 An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on publi
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. This was possible because the authorization check only verified that the installation had read permissions on the target repository rather than verifying that the token's installation was explicitly granted access to that repository. An attacker who obtained a victim's user-to-server token could create issues, issue comments, commit comments, and private vulnerability reports on any public repository, appearing as the victim user with no indication of the app involvement. This vulnerability was fixed by adding a repository scope check for user
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.github.com/en/[email protected]/admin/release-notes#3.16.20https://docs.github.com/en/[email protected]/admin/release-notes#3.17.17https://docs.github.com/en/[email protected]/admin/release-notes#3.18.11https://docs.github.com/en/[email protected]/admin/release-notes#3.19.8https://docs.github.com/en/[email protected]/admin/release-notes#3.20.4https://docs.github.com/en/[email protected]/admin/release-notes#3.21.2
2026-07-01
Published