Github Enterprise Server vulnerabilities

CVE-2023-6804 [MEDIUM] CWE-269 CVE-2023-6804: Improper privilege management allowed arbitrary workflows to be committed and run using an improperl Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.

CVE-2024-6395 [MEDIUM] CWE-200 CVE-2024-6395: An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attack An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that utilize deploy keys. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.

CVE-2025-13744 [MEDIUM] CWE-79 CVE-2025-13744: An Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHu An Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed attacker controlled HTML to be rendered by the Filter component (search) across GitHub that could be used to exfiltrate sensitive information. An attacker would require permissions to create or modify the names of miles

CVE-2026-77912 [MEDIUM] CWE-79 CVE-2026-77912: A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that al A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without re-sanitizing the result. Crafted Markdown could abuse same-or

CVE-2024-1084 [MEDIUM] CWE-79 CVE-2024-1084: Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Se Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user interaction and social engineering to make changes to a user account via CSP bypass with created CSRF tokens. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fi

CVE-2022-23733 [MEDIUM] CWE-79 CVE-2022-23733: A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github's Content Security Policy (CSP). This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.3.11, 3.4.6 and 3.5.3. This vulnerability was repor

CVE-2023-23763 [MEDIUM] CWE-200 CVE-2023-23763: An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upstream repository after its visibility was changed to private. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.10.0 and was fixed in versions 3.9.4, 3.8.9, 3.7.16

CVE-2024-8770 [MEDIUM] CWE-79 CVE-2024-8770: A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitH A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vuln

CVE-2026-2266 [MEDIUM] CWE-79 CVE-2026-2266: An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that al An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed DOM-based cross-site scripting via task list content. The task list content extraction logic did not properly re-encode browser-decoded text nodes before rendering, allowing user-supplied HTML to be injected into the page. An authenticated attacker

CVE-2023-51379 [MEDIUM] CWE-863 CVE-2023-51379: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed iss An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required contents:write and issues:read permissions. This vulnerability affected all versions of GitHu

CVE-2026-3306 [MEDIUM] CWE-639 CVE-2026-3306: An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a us An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repos

CVE-2026-5512 [MEDIUM] CWE-201 CVE-2026-5512: An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an a An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositorie

CVE-2026-3582 [MEDIUM] CWE-862 CVE-2026-3582: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through

CVE-2024-7711 [MEDIUM] CWE-863 CVE-2024-7711: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an att An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any issue inside a public repository. This was only exploitable inside a public repository. This vulnerability affected GitHub Enterprise Server versions before 3.14 and was fixed in versions 3.13.3, 3

CVE-2025-3124 [MEDIUM] CWE-862 CVE-2025-3124: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overview was required to be filtered only using the `archived:` filter and all other access controls

CVE-2023-51380 [MEDIUM] CWE-863 CVE-2023-51380: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed iss An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.

CVE-2025-6981 [MEDIUM] CWE-863 CVE-2025-6981: An incorrect authorization vulnerability allowed unauthorized read access to the contents of interna An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors API feature was enabled. The Contractors API is a rarely-enabled feature in private preview. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18 and was fixed in

CVE-2021-22868 [MEDIUM] CVE-2021-22868: A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited wh A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need per

CVE-2024-9539 [MEDIUM] CWE-200 CVE-2024-9539: An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uplo An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata information of a user who clicks on the URL and further exploit it to create a convincing phishing page. This required the attacker to upload malicious SVG files and phish a victim user to click

CVE-2022-46257 [MEDIUM] CWE-200 CVE-2022-46257: An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed priv An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploit this vulnerability, an attacker would need access to