Github Enterprise Server vulnerabilities

CVE-2024-5746 [HIGH] CWE-918 CVE-2024-5746: A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role. This vulne

CVE-2026-7541 [HIGH] CWE-770 CVE-2026-7541: A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthe A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and

CVE-2024-3684 [HIGH] CWE-88 CVE-2024-3684: A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin access to the appliance when configuring the Artifacts & Logs and Migrations Storage. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and acc

CVE-2024-3470 [HIGH] CWE-269 CVE-2024-3470: An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allow An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use a deploy key pertaining to an organization to bypass an organization ruleset. An attacker would require access to a valid deploy key for a repository in the organization as well as repository administrator access. This vulnerability

CVE-2026-4821 [HIGH] CWE-78 CVE-2026-4821: An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Ser An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as http_proxy. Exploitation of this vulnerability required access to the GitHub Enterpr

CVE-2026-6736 [MEDIUM] CWE-306 CVE-2026-6736: An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an un An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation

CVE-2023-46648 [HIGH] CWE-331 CVE-2023-46648: An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES Management Console. To exploit this vulnerability, an attacker would need knowledge that a user invitation was pending. This vulnerability affected all versions of GitHub Enterprise Server since

CVE-2022-23741 [HIGH] CWE-863 CVE-2022-23741: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a s An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerabilit

CVE-2026-1355 [MEDIUM] CWE-862 CVE-2026-1355: A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an att A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user’s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim’s

CVE-2026-1999 [MEDIUM] CWE-863 CVE-2026-1999: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge their own pull request into a repository without having push access by exploiting an authorization bypass in the enable_auto_merge mutation for pull requests. This issue only affected repositories that allow forking as the attack relies

CVE-2023-23764 [HIGH] CWE-697 CVE-2023-23764: An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHub pull request UI. To do so, an attacker would need write access to the repository. This vulnerability affected GitHub Enterprise Server versions 3.7.0 and above and was fixed in versions 3.7.9,

CVE-2024-1082 [MEDIUM] CWE-22 CVE-2024-1082: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker t A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker to gain unauthorized read permission to files by deploying arbitrary symbolic links to a GitHub Pages site with a specially crafted artifact tarball. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site

CVE-2024-5817 [MEDIUM] CWE-863 CVE-2024-5817: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed rea An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed read access to issue content via GitHub Projects. This was only exploitable in internal repositories and required the attacker to have access to the corresponding project board. This vulnerability affected all versions of GitHub Enterprise Server prior to

CVE-2024-1482 [MEDIUM] CWE-863 CVE-2024-1482: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUB_TOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected a

CVE-2024-10824 [MEDIUM] CWE-862 CVE-2024-10824: An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauth An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning alert data intended only for business owners. This issue could be exploited only by organization members with a personal access token (PAT) and required that secret scanning be enabled on user-

CVE-2024-6337 [MEDIUM] CWE-863 CVE-2024-6337: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a G An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pull_request_write: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access token was not impacted. This vulnerability affected al

CVE-2023-23766 [MEDIUM] CWE-697 CVE-2023-23766: An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened Pull Request. To do so, an attacker would need write access to the repository. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in versions 3.6.17, 3.7.15, 3.8

CVE-2021-22867 [MEDIUM] CWE-77 CVE-2021-22867: A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited wh A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would n

CVE-2021-22870 [MEDIUM] CWE-23 CVE-2021-22870: A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server tha A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterp

CVE-2023-6802 [MEDIUM] CWE-532 CVE-2023-6802: An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access to the management console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Bac