CVE-2026-75101
Received Received - Intake

Authorization Bypass in GitHub Enterprise Server

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc. (Products Only)

Description
An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to the repository name and pull request number rather than to a globally unique repository identifier, so an attacker who created a repository and pull request matching a target's repository name and pull request number could use a token for their own repository to retrieve the private pull request's contents. Exploitation required the attacker to know the target repository's name and a valid pull request number. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-75101

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
github enterprise_server to 3.22 (exc)
github enterprise_server 3.17.21
github enterprise_server 3.18.15
github enterprise_server 3.19.12
github enterprise_server 3.20.8
github enterprise_server 3.21.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in GitHub Enterprise Server where any authenticated user could read raw diffs or patches of private repository pull requests without proper authorization. Attackers exploited it by creating a repository and pull request matching a target's details, then using their own access token to retrieve private content.

Detection Guidance

This vulnerability requires checking for unauthorized access to private repository diffs or patches via pull requests. Monitor GitHub Enterprise Server logs for unusual access patterns to raw diff endpoints. Verify all users have appropriate permissions and no unexpected tokens are generated for repository access.

Impact Analysis

If you use GitHub Enterprise Server versions before 3.22, an attacker with knowledge of your repository name and a valid pull request number could access sensitive diffs or patches of private repositories. This could lead to unauthorized exposure of code changes, discussions, or other confidential information in your private projects.

Compliance Impact

This vulnerability could lead to unauthorized access to private repository data, potentially exposing sensitive information. This may violate compliance requirements under GDPR (data protection) and HIPAA (health data privacy) if such data is mishandled or exposed.

Mitigation Strategies

Upgrade GitHub Enterprise Server to a patched version (3.17.21, 3.18.15, 3.19.12, 3.20.8, or 3.21.6 or later) to address the authorization bypass vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75101. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart