CVE catalog
CVE-2026-5845
An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the inte
- Severity
- High · CVSS 7.2
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.29% · Oct 25, 2026
An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context, which could be chained with token revocation timing and SSH push attribution to obtain and reuse a victim-scoped token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | enterprise_server | Not reported | 3.14.26 | fixed |
| Cpe | enterprise_server | Not reported | 3.15.21 | fixed |
| Cpe | enterprise_server | Not reported | 3.16.17 | fixed |
| Cpe | enterprise_server | Not reported | 3.17.14 | fixed |
| Cpe | enterprise_server | Not reported | 3.18.8 | fixed |
| Cpe | enterprise_server | Not reported | 3.19.5 | fixed |
| Cpe | enterprise_server | Not reported | Not reported | unknown |
| Cpe | enterprise_server | Not reported | Not reported | unknown |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | enterprise_server | cpe | Not reported | 3.14.26 | Not reported | Not reported | Not reported |
| Cpe | enterprise_server | cpe | Not reported | 3.15.21 | Not reported | Not reported | Not reported |
| Cpe | enterprise_server | cpe | Not reported | 3.16.17 | Not reported | Not reported | Not reported |
| Cpe | enterprise_server | cpe | Not reported | 3.17.14 | Not reported | Not reported | Not reported |
| Cpe | enterprise_server | cpe | Not reported | 3.18.8 | Not reported | Not reported | Not reported |
| Cpe | enterprise_server | cpe | Not reported | 3.19.5 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26]
- [https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21]
- [https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17]
- [https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14]
- [https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8]
- [https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5]
- [https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-5845]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1231.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]