CVE-2026-1355 in GitHub
Summary
by MITRE • 02/18/2026
A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user’s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim’s migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23. This vulnerability was reported via the GitHub Bug Bounty program.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 02/21/2026
This vulnerability represents a critical authorization flaw in GitHub Enterprise Server that undermines the integrity of repository migration operations. The issue stems from insufficient access controls within the repository migration upload endpoint, creating a scenario where authenticated attackers can manipulate migration data belonging to other users. The vulnerability specifically affects the migration export process, where attackers can exploit a missing authorization check to upload content to repositories they do not own or control. This represents a direct violation of the principle of least privilege and demonstrates a failure in the server's access control mechanisms. The flaw enables attackers to replace legitimate migration archives with malicious content, fundamentally compromising the trust model of the migration system.
The technical exploitation of this vulnerability requires an attacker to possess valid authentication credentials for the target GitHub Enterprise Server instance, which limits the attack surface but does not eliminate the risk. The attack vector involves supplying a valid migration identifier, which allows the attacker to overwrite existing migration archives. This authorization bypass occurs at the application layer where the system fails to verify that the requesting user has proper permissions to modify another user's migration data. The vulnerability is classified as a missing authorization check, which aligns with CWE-862 and represents a failure in access control implementation. The impact extends beyond simple data modification to potential data integrity compromise during migration restores, where victims might unknowingly import attacker-controlled repository data.
The operational implications of this vulnerability are significant for organizations relying on GitHub Enterprise Server for version control and collaboration. When users perform migration operations, they expect the system to maintain data integrity and prevent unauthorized modifications to their repository content. The vulnerability creates a potential attack path where malicious actors could inject harmful code, backdoors, or misleading data into repository migrations, affecting downstream processes including automated imports and restore operations. This compromise of migration data integrity can lead to extended security incidents, as compromised repositories may contain malicious code that propagates through development workflows. The vulnerability affects all versions prior to 3.20, indicating a prolonged window of exposure that organizations may have been unknowingly vulnerable to. Organizations using older versions face increased risk of supply chain attacks or data corruption during migration processes.
Mitigation strategies should focus on immediate version upgrades to patched releases including 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, and 3.14.23, which address the authorization bypass in the repository migration upload endpoint. Organizations should also implement additional monitoring of migration operations and access logs to detect unauthorized activities. Security teams should conduct comprehensive audits of migration processes and verify that proper access controls are in place for all repository operations. The vulnerability highlights the importance of implementing robust access control mechanisms and regular security assessments of enterprise platforms. This issue demonstrates the critical need for continuous vulnerability management and the value of coordinated disclosure programs like the GitHub Bug Bounty initiative that help identify and remediate such security flaws before they can be exploited in the wild. Organizations should also consider implementing additional security controls around migration operations and establish procedures for verifying migration data integrity during restore processes.