PT-2026-34212 · Github · Github Enterprise Server

Ahacker1 · Published 2026-04-21 · Updated 2026-04-27 · CVE-2026-5845

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21

Description An improper authorization issue exists in scoped user-to-server (ghu ) token authorization. An authenticated attacker can access private repositories outside the intended installation scope, potentially performing write operations. This occurs due to an authorization fallback that treats a revoked or deleted installation as a global installation context, which may be combined with token revocation timing and SSH push attribution to obtain and reuse a victim-scoped token.

Recommendations Update to version 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, or 3.14.26.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-5845

Affected Products

Github Enterprise Server

References · 11

• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5845 · Security Note
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21 · Vendor Advisory
• https://twitter.com/CVEnew/status/2048168415345688810 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046856033587364205 · Twitter Post
• https://twitter.com/integ_sec/status/2048775237064351968 · Twitter Post