CVE-2026-3582
Received Received - Intake
Incorrect Authorization in GitHub Enterprise Server Allows Data Exposure

Publication date: 2026-03-10

Last updated on: 2026-03-12

Assigner: GitHub, Inc. (Products Only)

Description
An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-03-12
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-3582
EUVD
EUVD-2026-10828
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
github enterprise_server to 3.16.15 (exc)
github enterprise_server From 3.17.0 (inc) to 3.17.12 (exc)
github enterprise_server From 3.18.0 (inc) to 3.18.6 (exc)
github enterprise_server From 3.19.0 (inc) to 3.19.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an Incorrect Authorization issue in GitHub Enterprise Server. It allowed an authenticated user who had a classic personal access token (PAT) without the required 'repo' scope to access issues and commits from private and internal repositories using the search REST API endpoints.

However, to exploit this vulnerability, the user needed to already have access to the repository through organization membership or as a collaborator.

The vulnerability affected all versions of GitHub Enterprise Server before version 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6, and 3.19.3.

Impact Analysis

This vulnerability could allow an authenticated user with limited permissions (a PAT lacking the repo scope) to retrieve sensitive information such as issues and commits from private and internal repositories.

This could lead to unauthorized disclosure of potentially confidential or proprietary information within those repositories.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, upgrade your GitHub Enterprise Server to one of the fixed versions: 3.16.15, 3.17.12, 3.18.6, or 3.19.3.

Ensure that personal access tokens (PATs) without the repo scope are not used to access private or internal repositories.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart