Log in Start free

Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_P

CVE-2026-5845Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server

High 7.2

In plain English

A high-severity authorization bypass via user-controlled key in Enterprise Server from GitHub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)7.2High
Exploit odds (30 days)0.3%top 78.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context, which could be chained with token revocation timing and SSH push attribution to obtain and reuse a victim-scoped token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

Affected products (as reported)

VendorProductVersions
GitHub Enterprise Server 3.20.0 – before 3.20.13.19.0 – through 3.19.43.18.0 – through 3.18.73.17.0 – through 3.17.133.16.0 – through 3.16.163.15.0 – through 3.15.203.14.0 – through 3.14.25

Weakness: CWE-639 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

References