CVE-2026-103620

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc. (Products Only)

Description

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required pull-request review but did not restrict branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content. This vulnerability affected supported GitHub Enterprise Server releases in the 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.18.16, 3.19.13, 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103620

EUVD

EUVD-2026-93666

Affected Vendors & Products

Vendor	Product	Version / Range
GitHub	Enterprise	Server 3.18.0
GitHub	Enterprise	Server 3.19.0
GitHub	Enterprise	Server 3.20.0
GitHub	Enterprise	Server 3.21.0
GitHub	Enterprise	Server 3.22.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authorization issue in GitHub Enterprise Server. A repository collaborator with write access could delete the current default branch via the GraphQL API. This allowed an attacker-controlled branch to become the new default, bypassing pull-request review requirements in repositories that did not restrict branch deletion.

Detection Guidance

This vulnerability can be detected by checking GitHub Enterprise Server versions against the fixed releases (3.18.16, 3.19.13, 3.20.9, 3.21.7, 3.22.2). Verify if any repositories allow branch deletion without proper restrictions or if the default branch was changed unexpectedly.

Impact Analysis

If exploited, this vulnerability could allow an attacker to replace the default branch of a repository with malicious code. This could lead to unauthorized changes being pulled into local clones or API requests, potentially causing data breaches or system compromises.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized branch deletion in repositories with pull-request review requirements. This bypasses review controls, enabling attacker-controlled content to become the default branch, which may lead to unauthorized code execution or data exposure. Such unauthorized changes could violate access control and audit requirements mandated by these regulations.

Mitigation Strategies

Update GitHub Enterprise Server to the fixed versions (3.18.16, 3.19.13, 3.20.9, 3.21.7, or 3.22.2) immediately to address the missing authorization vulnerability.

Hi! I’m here to help you understand CVE-2026-103620. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70