PT-2026-20503 · Github · Github Enterprise Server

Ahacker1 · Published 2026-02-18 · Updated 2026-02-19 · CVE-2026-1355

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.20 GitHub Enterprise Server versions 3.19.2 through 3.19.2 GitHub Enterprise Server versions 3.18.5 through 3.18.5 GitHub Enterprise Server versions 3.17.11 through 3.17.11 GitHub Enterprise Server versions 3.16.14 through 3.16.14 GitHub Enterprise Server versions 3.15.18 through 3.15.18 GitHub Enterprise Server versions 3.14.23 through 3.14.23

Description A missing authorization check exists in the repository migration upload endpoint of GitHub Enterprise Server. An attacker with authentication to the instance can upload unauthorized content to another user’s repository migration export by supplying the migration identifier. This allows overwriting or replacing a victim’s migration archive, potentially leading to the download of attacker-controlled repository data during migration restores or automated imports.

Recommendations Update to GitHub Enterprise Server version 3.20 or later. Update to GitHub Enterprise Server version 3.19.2. Update to GitHub Enterprise Server version 3.18.5. Update to GitHub Enterprise Server version 3.17.11. Update to GitHub Enterprise Server version 3.16.14. Update to GitHub Enterprise Server version 3.15.18. Update to GitHub Enterprise Server version 3.14.23.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1355

Affected Products

Github Enterprise Server

References · 10

• https://osv.dev/vulnerability/CVE-2026-1355 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1355 · Security Note
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.5 · Note
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.11 · Note
• https://twitter.com/CVEnew/status/2024233235291467953 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2 · Note
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.18 · Note
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.23 · Note
• https://t.me/cveNotify/152528 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.14 · Note