PT-2026-20503 · Github · Github Enterprise Server

Ahacker1 · Publicado 2026-02-18 · Atualizado 2026-02-19 · CVE-2026-1355

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.20 GitHub Enterprise Server versions 3.19.2 through 3.19.2 GitHub Enterprise Server versions 3.18.5 through 3.18.5 GitHub Enterprise Server versions 3.17.11 through 3.17.11 GitHub Enterprise Server versions 3.16.14 through 3.16.14 GitHub Enterprise Server versions 3.15.18 through 3.15.18 GitHub Enterprise Server versions 3.14.23 through 3.14.23

Description A missing authorization check exists in the repository migration upload endpoint of GitHub Enterprise Server. An attacker with authentication to the instance can upload unauthorized content to another user’s repository migration export by supplying the migration identifier. This allows overwriting or replacing a victim’s migration archive, potentially leading to the download of attacker-controlled repository data during migration restores or automated imports.

Recommendations Update to GitHub Enterprise Server version 3.20 or later. Update to GitHub Enterprise Server version 3.19.2. Update to GitHub Enterprise Server version 3.18.5. Update to GitHub Enterprise Server version 3.17.11. Update to GitHub Enterprise Server version 3.16.14. Update to GitHub Enterprise Server version 3.15.18. Update to GitHub Enterprise Server version 3.14.23.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1355

Produtos afetados

Github Enterprise Server

Referências · 10

• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.5 · Nota
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.11 · Nota
• https://twitter.com/CVEnew/status/2024233235291467953 · Publicação no Twitter
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2 · Nota
• https://osv.dev/vulnerability/CVE-2026-1355 · Aviso do Fabricante
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.18 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1355 · Nota de Segurança
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.23 · Nota
• https://t.me/cveNotify/152528 · Publicação no Telegram
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.14 · Nota