Log in Start free

Vulnerability · Published Jun 30, 2026 · Assigned by GitHub_P

CVE-2026-9106UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen

Medium 4.8

In plain English

A medium-severity security flaw in Enterprise Server from GitHub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium
Exploit odds (30 days)0.4%top 69.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.

Affected products (as reported)

VendorProductVersions
GitHub Enterprise Server 3.17.0 – through 3.17.163.18.0 – through 3.18.103.19.0 – through 3.19.73.20.0 – through 3.20.33.21.0 – through 3.21.13.16.0 – through 3.16.19

Weakness: CWE-451 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References