PT-2026-20504 · Github · Github Enterprise Server

Ahacker1

+1

·

Publicado

2026-02-18

·

Atualizado

2026-02-19

·

CVE-2026-1999

CVSS v4.0

7.2

Alta

VetorAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:L
Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.17.11 GitHub Enterprise Server versions prior to 3.18.5 GitHub Enterprise Server versions prior to 3.19.2
Description An authorization flaw exists in GitHub Enterprise Server that could allow an attacker to merge a pull request into a repository without necessary push permissions. This is due to an authorization bypass in the enable auto merge mutation for pull requests. The issue requires the target repository to allow forking and relies on opening a pull request from a fork controlled by the attacker. Successful exploitation is limited to pull requests with a clean status and branches lacking branch protection rules.
Recommendations Update GitHub Enterprise Server to version 3.17.11 or later. Update GitHub Enterprise Server to version 3.18.5 or later. Update GitHub Enterprise Server to version 3.19.2 or later.

Correção

Incorrect Authorization

SSRF

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-863CWE-918

Identificadores relacionados

CVE-2026-1999

Produtos afetados

Github Enterprise Server