PT-2025-29685 · Github · Github Enterprise Server

Published 2025-07-15 · Updated 2025-08-27 · CVE-2025-6981

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.18 GitHub Enterprise Server versions 3.14.15 GitHub Enterprise Server versions 3.15.10 GitHub Enterprise Server versions 3.16.6 GitHub Enterprise Server versions 3.17.3

Description An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors API feature was enabled. The Contractors API is a rarely-enabled feature in private preview.

Recommendations Update to GitHub Enterprise Server version 3.14.15. Update to GitHub Enterprise Server version 3.15.10. Update to GitHub Enterprise Server version 3.16.6. Update to GitHub Enterprise Server version 3.17.3. Update to GitHub Enterprise Server version 3.18.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-6981

Affected Products

Github Enterprise Server

References · 9

• https://osv.dev/vulnerability/CVE-2025-6981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6981 · Security Note
• https://twitter.com/CVEnew/status/1945226024674799674 · Twitter Post
• https://t.me/cvetracker/27914 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.6 · Note
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.10 · Note
• https://t.me/cveNotify/133698 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.3 · Note
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.15 · Note