PT-2026-24363 · Github · Github Enterprise Server

Ahacker1 · Published 2026-03-10 · Updated 2026-03-25 · CVE-2026-3306

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.14.24 through 3.19.3

Description An improper authorization issue was found in GitHub Enterprise Server. A user with read access to a repository and write access to a project could modify issue and pull request metadata through the project. Column value updates were applied without verifying the actor's repository write permissions when adding an item to an existing project. This issue was reported through the GitHub Bug Bounty program.

Recommendations Update to GitHub Enterprise Server version 3.14.24. Update to GitHub Enterprise Server version 3.15.19. Update to GitHub Enterprise Server version 3.16.15. Update to GitHub Enterprise Server version 3.17.12. Update to GitHub Enterprise Server version 3.18.6. Update to GitHub Enterprise Server version 3.19.3.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-3306

Affected Products

Github Enterprise Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-3306 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3306 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2033196244961480957 · Twitter Post
• https://twitter.com/CVEnew/status/2033194356774253027 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24 · Note
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12 · Note
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6 · Note
• https://twitter.com/TheRabbitPy/status/2036765224888402418 · Twitter Post
• https://t.me/cveNotify/155339 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3 · Note
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15 · Note
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.19 · Note