CVE-2026-14340
Full vulnerability record from the local CVENow database.
Description
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. This was possible because the authorization check only verified that the installation had read permissions on the target repository rather than verifying that the token's installation was explicitly granted access to that repository. An attacker who obtained a victim's user-to-server token could create issues, issue comments, commit comments, and private vulnerability reports on any public repository, appearing as the victim user with no indication of the app involvement. This vulnerability was fixed by adding a repository scope check for user-to-server tokens issued by global apps. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
Severity
MEDIUM
CVSS score
5.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-01 21:16:43.743000
Last modified
2026-10-25 16:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-14340",
"sourceIdentifier": "[email protected]",
"published": "2026-07-01T21:16:43.743",
"lastModified": "2026-10-25T16:10:00.147",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. This was possible because the authorization check only verified that the installation had read permissions on the target repository rather than verifying that the token's installation was explicitly granted access to that repository. An attacker who obtained a victim's user-to-server token could create issues, issue comments, commit comments, and private vulnerability reports on any public repository, appearing as the victim user with no indication of the app involvement. This vulnerability was fixed by adding a repository scope check for user-to-server tokens issued by global apps. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program."
},
{
"lang": "es",
"value": "Una vulnerabilidad de autorización incorrecta fue identificada en GitHub Enterprise Server que permitía que un token de usuario a servidor con alcance a una instalación de GitHub App realizara ciertas operaciones de escritura en repositorios públicos fuera del alcance previsto del token. Esto fue posible porque la verificación de autorización solo verificaba que la instalación tenía permisos de lectura en el repositorio de destino en lugar de verificar que a la instalación del token se le había concedido acceso explícitamente a ese repositorio. Un atacante que obtuviera un token de usuario a servidor de una víctima podría crear incidencias, comentarios de incidencias, comentarios de commits e informes de vulnerabilidad privados en cualquier repositorio público, apareciendo como el usuario víctima sin ninguna indicación de la participación de la aplicación. Esta vulnerabilidad fue corregida añadiendo una verificación de alcance de repositorio para tokens de usuario a servidor emitidos por aplicaciones globales. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.22 y fue corregida en las versiones 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. Esta vulnerabilidad fue reportada a través del programa GitHub Bug Bounty."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "GitHub",
"product": "Enterprise Server",
"defaultStatus": "affected",
"platforms": [
"Linux"
],
"versions": [
{
"version": "3.16.0",
"lessThanOrEqual": "3.16.19",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.16.20",
"status": "unaffected"
}
]
},
{
"version": "3.17.0",
"lessThanOrEqual": "3.17.16",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.17.17",
"status": "unaffected"
}
]
},
{
"version": "3.18.0",
"lessThanOrEqual": "3.18.10",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.18.11",
"status": "unaffected"
}
]
},
{
"version": "3.19.0",
"lessThanOrEqual": "3.19.7",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.19.8",
"status": "unaffected"
}
]
},
{
"version": "3.20.0",
"lessThanOrEqual": "3.20.3",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.20.4",
"status": "unaffected"
}
]
},
{
"version": "3.21.0",
"lessThanOrEqual": "3.21.1",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.21.2",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-02T15:10:33.189761Z",
"id": "CVE-2026-14340",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.16.20",
"matchCriteriaId": "09FDB053-8EF5-4CAF-9C05-090985C57A77"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.17.0",
"versionEndExcluding": "3.17.17",
"matchCriteriaId": "F0612BD3-C04E-4A34-ACEF-4D1F4F723E47"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.0",
"versionEndExcluding": "3.18.11",
"matchCriteriaId": "0553891C-ED0B-4D2C-A832-29996F0CE8B2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.19.0",
"versionEndExcluding": "3.19.8",
"matchCriteriaId": "E67B4A61-E777-4B50-8DFC-DDF6292C4771"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.20.0",
"versionEndExcluding": "3.20.4",
"matchCriteriaId": "A51E85E4-FF55-497C-A39F-F69E224E63BD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.21.0",
"versionEndExcluding": "3.21.2",
"matchCriteriaId": "051B2085-DBF2-420B-B356-70C0AB2D97C7"
}
]
}
]
}
],
"references": [
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.16.20",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.17.17",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.18.11",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.19.8",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.20.4",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.21.2",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
}
]
}