PT-2026-53988 · Github · Github Enterprise Server

Vaibhav Singh · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-9106

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22

Description A UI misrepresentation issue allows an OAuth application to obtain unauthorized access to organization runner management. An attacker can exploit this by creating an OAuth application that requests the manage runners:org scope and tricking a user into authorizing it, because this specific scope is not displayed on the authorization consent screen.

Recommendations Update to version 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, or 3.16.20.

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

CVE-2026-9106

Affected Products

Github Enterprise Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-9106 · Security Note
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8 · Note
• https://twitter.com/infoflowcloud/status/2072078216911573253 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17 · Note
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11 · Note
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.20 · Note
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4 · Note
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.2 · Note
• https://twitter.com/CVEnew/status/2072076798565990414 · Twitter Post