CVE-2026-3307
Authorization Bypass in GitHub Enterprise Server Secret Scanning
Publication date: 2026-04-21
Last updated on: 2026-04-29
Assigner: GitHub, Inc. (Products Only)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| github | enterprise_server | to 3.14.26 (exc) |
| github | enterprise_server | From 3.15.0 (inc) to 3.15.21 (exc) |
| github | enterprise_server | From 3.16.0 (inc) to 3.16.17 (exc) |
| github | enterprise_server | From 3.17.0 (inc) to 3.17.14 (exc) |
| github | enterprise_server | From 3.18.0 (inc) to 3.18.8 (exc) |
| github | enterprise_server | From 3.19.0 (inc) to 3.19.5 (exc) |
| github | enterprise_server | 3.20.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an authorization bypass in GitHub Enterprise Server. It allows an attacker who already has admin access to one repository to modify the secret scanning push protection delegated bypass reviewer list on a different repository. The attacker does this by manipulating the owner_id parameter in the request body. Although authorization is checked against the repository in the URL, the action is applied to another repository specified in the request body.
The impact is limited because the attacker can only assign existing trusted users as bypass reviewers; they cannot add arbitrary external users.
How can this vulnerability impact me? :
The vulnerability could allow an attacker with admin rights on one repository to alter the secret scanning push protection settings on another repository by assigning trusted users as bypass reviewers. This could potentially weaken the security controls around secret scanning on the affected repository, allowing certain pushes to bypass secret scanning protections.
However, the attacker cannot add arbitrary external users as bypass reviewers, which limits the scope of the impact.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your GitHub Enterprise Server to one of the fixed versions: 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, or 3.20.1.
This will ensure that the authorization bypass vulnerability related to secret scanning push protection delegated bypass reviewer list manipulation is resolved.