GitHub Enterprise Server up to 3.17.16/3.18.10/3.19.7/3.20.3 authorization

Summaryinfo

A vulnerability, which was classified as problematic, was found in GitHub Enterprise Server up to 3.17.16/3.18.10/3.19.7/3.20.3. Affected is an unknown function. Such manipulation leads to authorization. This vulnerability is referenced as CVE-2026-9132. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in GitHub Enterprise Server up to 3.17.16/3.18.10/3.19.7/3.20.3 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. CVE summarizes:

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program.

The weakness was published by Seokchan Yoon. The advisory is shared for download at docs.github.com. This vulnerability is handled as CVE-2026-9132 since 05/20/2026. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2164). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Microsoft GitHub Enterprise

Productinfo

Type

• Bug Tracking Software

Vendor

• GitHub

Name

• Enterprise Server

Version

• 3.17.0
• 3.17.1
• 3.17.2
• 3.17.3
• 3.17.4
• 3.17.5
• 3.17.6
• 3.17.7
• 3.17.8
• 3.17.9
• 3.17.10
• 3.17.11
• 3.17.12
• 3.17.13
• 3.17.14
• 3.17.15
• 3.17.16
• 3.18.0
• 3.18.1
• 3.18.2
• 3.18.3
• 3.18.4
• 3.18.5
• 3.18.6
• 3.18.7
• 3.18.8
• 3.18.9
• 3.18.10
• 3.19.0
• 3.19.1
• 3.19.2
• 3.19.3
• 3.19.4
• 3.19.5
• 3.19.6
• 3.19.7
• 3.20.0
• 3.20.1
• 3.20.2
• 3.20.3

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion