PT-2026-24363 · Github · Github Enterprise Server

Ahacker1 · Publicado 2026-03-10 · Atualizado 2026-03-25 · CVE-2026-3306

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.14.24 through 3.19.3

Description An improper authorization issue was found in GitHub Enterprise Server. A user with read access to a repository and write access to a project could modify issue and pull request metadata through the project. Column value updates were applied without verifying the actor's repository write permissions when adding an item to an existing project. This issue was reported through the GitHub Bug Bounty program.

Recommendations Update to GitHub Enterprise Server version 3.14.24. Update to GitHub Enterprise Server version 3.15.19. Update to GitHub Enterprise Server version 3.16.15. Update to GitHub Enterprise Server version 3.17.12. Update to GitHub Enterprise Server version 3.18.6. Update to GitHub Enterprise Server version 3.19.3.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-3306

Produtos afetados

Github Enterprise Server

Referências · 12

• https://twitter.com/infoflowcloud/status/2033196244961480957 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3306 · Nota de Segurança
• https://twitter.com/CVEnew/status/2033194356774253027 · Publicação no Twitter
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24 · Nota
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12 · Nota
• https://osv.dev/vulnerability/CVE-2026-3306 · Aviso do Fabricante
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6 · Nota
• https://twitter.com/TheRabbitPy/status/2036765224888402418 · Publicação no Twitter
• https://t.me/cveNotify/155339 · Publicação no Telegram
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3 · Nota
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15 · Nota
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.19 · Nota