CVE-2026-3582 — Missing Authorization in Github

Vendor	Product	Version range	Fixed in
github	enterprise_server	< 3.16.15	3.16.15
github	enterprise_server	3.16.0 – 3.16.14	—
github	enterprise_server	>= 3.17.0 < 3.17.12	3.17.12
github	enterprise_server	3.17.0 – 3.17.11	—
github	enterprise_server	>= 3.18.0 < 3.18.6	3.18.6
github	enterprise_server	3.18.0 – 3.18.5	—
github	enterprise_server	>= 3.19.0 < 3.19.3	3.19.3
github	enterprise_server	3.19.0 – 3.19.2	—

HackerOne

PATs without the required scope can leak issues

hackerone·2026-03-19·CVSS 5.3

[MEDIUM] PATs without the required scope can leak issues PATs without the required scope can leak issues An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. [CVE-2026-3582](https://www.cve.org/cverecord?id=CVE-2026-3582)

Wiz

CVE-2026-3854 Impact, Exploitability, and Mitigation Steps | Wiz

blogs_wiz·CVSS 7.1

CVE-2026-3854 [HIGH] CVE-2026-3854 Impact, Exploitability, and Mitigation Steps | Wiz ## CVE-2026-3854 : GitHub Enterprise Server vulnerability analysis and mitigation An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3

Wiz

CVE-2026-3306 Impact, Exploitability, and Mitigation Steps | Wiz

blogs_wiz·CVSS 7.1

CVE-2026-3306 [HIGH] CVE-2026-3306 Impact, Exploitability, and Mitigation Steps | Wiz ## CVE-2026-3306 : GitHub Enterprise Server vulnerability analysis and mitigation An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3. Source : NVD ## 5.3 Score Published March 10, 2026 Severity MEDIUM CNA Score 5.3 Affected Technologies GitHub Enterprise Server Has Public Exploit No

Wiz

CVE-2025-13744 Impact, Exploitability, and Mitigation Steps | Wiz

blogs_wiz·CVSS 8.4

CVE-2025-13744 [HIGH] CVE-2025-13744 Impact, Exploitability, and Mitigation Steps | Wiz ## CVE-2025-13744 : GitHub Enterprise Server vulnerability analysis and mitigation An Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed attacker controlled HTML to be rendered by the Filter component (search) across GitHub that could be used to exfiltrate sensitive information. An attacker would require permissions to create or modify the names of milestones, issues, pull requests, or similar entities that are rendered in the vulnerable filter/search components. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.1, and 3.18.2, 3.17.8, 3.16.11, 3.15.15, and 3.14.20. This vulnerability was reported via the GitHub Bug Bounty program. Source : NVD

Wiz

CVE-2025-14046 Impact, Exploitability, and Mitigation Steps | Wiz

blogs_wiz·CVSS 8.6

CVE-2025-14046 [HIGH] CVE-2025-14046 Impact, Exploitability, and Mitigation Steps | Wiz ## CVE-2025-14046 : GitHub Enterprise Server vulnerability analysis and mitigation An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs that collided with server-initialized data islands. These collisions could overwrite or shadow critical application state objects used by certain Project views, leading to unintended server-side POST requests or other unauthorized backend interactions. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a privileged user to view crafted malicious content that includes conflicting HTML elements. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.3, 3.17

Wiz

CVE-2026-2266 Impact, Exploitability, and Mitigation Steps | Wiz

blogs_wiz·CVSS 7.1

CVE-2026-2266 [HIGH] CVE-2026-2266 Impact, Exploitability, and Mitigation Steps | Wiz ## CVE-2026-2266 : GitHub Enterprise Server vulnerability analysis and mitigation An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed DOM-based cross-site scripting via task list content. The task list content extraction logic did not properly re-encode browser-decoded text nodes before rendering, allowing user-supplied HTML to be injected into the page. An authenticated attacker could craft malicious task list items in issues or pull requests to execute arbitrary scripts in the context of another user's browser session. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program. Source : NVD ## 7.4

Wiz

CVE-2026-1355 Impact, Exploitability, and Mitigation Steps | Wiz

blogs_wiz·CVSS 6.0

CVE-2026-1355 [MEDIUM] CVE-2026-1355 Impact, Exploitability, and Mitigation Steps | Wiz ## CVE-2026-1355 : GitHub Enterprise Server vulnerability analysis and mitigation A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user’s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim’s migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.2, 3.18.5, 3.

Wiz

CVE-2026-1999 Impact, Exploitability, and Mitigation Steps | Wiz

blogs_wiz·CVSS 7.1

CVE-2026-1999 [HIGH] CVE-2026-1999 Impact, Exploitability, and Mitigation Steps | Wiz ## CVE-2026-1999 : GitHub Enterprise Server vulnerability analysis and mitigation A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to access internal services bound to loopback or unspecified addresses, potentially disrupting background job processing, accessing administrative endpoints, metrics, and profiling data, or manipulating job queues. Exploitation required an authenticated user with permissions to configure webhooks (repository, organization, or GitHub App administrator privileges). This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.14.22, 3.15.17, 3.16.13, 3.17.10, 3.18.4, and 3.19.1. This vulnerability was reported via the GitHub Bug Bount

Wiz

CVE-2026-3582 Impact, Exploitability, and Mitigation Steps | Wiz

blogs_wiz·CVSS 7.1

CVE-2026-3582 [HIGH] CVE-2026-3582 Impact, Exploitability, and Mitigation Steps | Wiz ## CVE-2026-3582 : GitHub Enterprise Server vulnerability analysis and mitigation An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program. Source : NVD ## 5.3 Score Published March 10, 2026 Seve

Wiz

CVE-2026-0573 Impact, Exploitability, and Mitigation Steps | Wiz

blogs_wiz·CVSS 7.6

CVE-2026-0573 [HIGH] CVE-2026-0573 Impact, Exploitability, and Mitigation Steps | Wiz ## CVE-2026-0573 : GitHub Enterprise Server vulnerability analysis and mitigation An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Serve

CVE-2026-3582: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token…

Affected

CVSS provenance