CVE-2026-5845
Full vulnerability record from the local CVENow database.
Description
An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context, which could be chained with token revocation timing and SSH push attribution to obtain and reuse a victim-scoped token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
Severity
HIGH
CVSS score
7.2
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-21 23:16:22.473000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-5845",
"sourceIdentifier": "[email protected]",
"published": "2026-04-21T23:16:22.473",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context, which could be chained with token revocation timing and SSH push attribution to obtain and reuse a victim-scoped token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program."
},
{
"lang": "es",
"value": "Una vulnerabilidad de autorización impropia en la autorización de tokens de usuario a servidor (ghu_) con ámbito en GitHub Enterprise Server permite a un atacante autenticado acceder a repositorios privados fuera del ámbito de instalación previsto, lo que puede incluir operaciones de escritura, a través de un mecanismo de respaldo de autorización que trataba una instalación revocada/eliminada como un contexto de instalación global, lo que podría encadenarse con la temporización de la revocación de tokens y la atribución de push SSH para obtener y reutilizar un token con ámbito de víctima. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y se corrigió en las versiones 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21 y 3.14.26. Esta vulnerabilidad fue reportada a través del programa GitHub Bug Bounty."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "GitHub",
"product": "Enterprise Server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.20.0",
"lessThan": "3.20.1",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.20.1",
"status": "unaffected"
}
]
},
{
"version": "3.19.0",
"lessThanOrEqual": "3.19.4",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.19.5",
"status": "unaffected"
}
]
},
{
"version": "3.18.0",
"lessThanOrEqual": "3.18.7",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.18.8",
"status": "unaffected"
}
]
},
{
"version": "3.17.0",
"lessThanOrEqual": "3.17.13",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.17.14",
"status": "unaffected"
}
]
},
{
"version": "3.16.0",
"lessThanOrEqual": "3.16.16",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.16.17",
"status": "unaffected"
}
]
},
{
"version": "3.15.0",
"lessThanOrEqual": "3.15.20",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.15.21",
"status": "unaffected"
}
]
},
{
"version": "3.14.0",
"lessThanOrEqual": "3.14.25",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.14.26",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 5.8
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-22T18:03:53.486677Z",
"id": "CVE-2026-5845",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-639"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.14.26",
"matchCriteriaId": "72A92258-9FCC-41E0-856B-3C2A495575A6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.15.0",
"versionEndExcluding": "3.15.21",
"matchCriteriaId": "3A14A459-881C-437A-88EC-D721E3005329"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.0",
"versionEndExcluding": "3.16.17",
"matchCriteriaId": "8B7DCD9A-2CF0-4D96-AA96-ACEC662A8E1F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.17.0",
"versionEndExcluding": "3.17.14",
"matchCriteriaId": "CEC2ADE6-3E31-4889-9A73-B6695FE0AB52"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.0",
"versionEndExcluding": "3.18.8",
"matchCriteriaId": "9B15B12E-00A8-48E8-81DE-54506B94A2C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.19.0",
"versionEndExcluding": "3.19.5",
"matchCriteriaId": "56903EAF-4579-4263-AB0F-863323E7C81A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:3.20.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DCA4F97D-688E-45D2-90C0-8A11E9B531AA"
}
]
}
]
}
],
"references": [
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.14.26",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.15.21",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.16.17",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.17.14",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.18.8",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.19.5",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.20.1",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
}
]
}