PT-2025-17244 · Github · Github Enterprise Server

Published

2025-04-17

·

Updated

2025-09-05

·

CVE-2025-3124

CVSS v4.0

5.3

Medium

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.17
Description A missing authorization issue was identified in GitHub Enterprise Server, allowing users to see the names of private repositories they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overview required filtering using the archived: filter, and all other access controls functioned normally.
Recommendations For versions prior to 3.13.14, update to version 3.13.14 or later. For versions prior to 3.14.11, update to version 3.14.11 or later. For versions prior to 3.15.6, update to version 3.15.6 or later. For versions prior to 3.16.2, update to version 3.16.2 or later. As a temporary workaround, consider restricting access to the Security Overview in GitHub Advanced Security until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-09686
CVE-2025-3124

Affected Products

Github Enterprise Server