CVE-2026-86544

Received Received - Intake

Authorization Bypass in GitHub Enterprise Server via Code Actions

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-86544

EUVD

EUVD-2026-72562

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects software versions before 0.30.0. It allows attackers with read-restricted access to bypass authorization checks. They can exploit a function called code.replace to modify permission settings and escalate their privileges for future actions.

Detection Guidance

To detect this vulnerability, check if your system is running a version of the affected software before 0.30.0. Review logs for unauthorized use of code.replace operations by read-restricted users. Monitor for unexpected changes in permission configurations.

Impact Analysis

Attackers could gain unauthorized access to modify system configurations, leading to privilege escalation. This could allow them to take control of the system or perform actions beyond their intended permissions, potentially causing data breaches or system damage.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations may face legal penalties, loss of trust, and failure to meet compliance standards due to potential data breaches.

Mitigation Strategies

Immediately upgrade to version 0.30.0 or later to patch the authorization bypass vulnerability. Review permission configurations for any unauthorized modifications and restrict access to code.replace operations for read-restricted sessions.

Hi! I’m here to help you understand CVE-2026-86544. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70