← Back to CVE Explorer

CVE-2026-6736

Full vulnerability record from the local CVENow database.

Description

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation and session establishment without identity provider validation. The created account was limited to the default base permissions configured on the instance. Exploitation required network access to a GHES instance configured with an external authentication provider. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.

Severity
MEDIUM
CVSS score
6.3 (v4.0)
Vulnerability status
Analyzed
Source identifier
[email protected]
Published
2026-05-07 22:16:36.753000
Last modified
2026-10-26 20:10:00.160000
View original CVE JSON 
{
  "id": "CVE-2026-6736",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-07T22:16:36.753",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation and session establishment without identity provider validation. The created account was limited to the default base permissions configured on the instance. Exploitation required network access to a GHES instance configured with an external authentication provider. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de omisión de autenticación fue identificada en GitHub Enterprise Server que permitía a un atacante no autenticado crear una cuenta de usuario local, omitiendo el proveedor de identidad externo configurado. Cuando la autenticación externa estaba habilitada, el endpoint de registro no aplicaba correctamente la restricción de autenticación, permitiendo la creación de cuentas y el establecimiento de sesiones sin validación del proveedor de identidad. La cuenta creada estaba limitada a los permisos base predeterminados configurados en la instancia. La explotación requería acceso de red a una instancia de GHES configurada con un proveedor de autenticación externo. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y fue corregida en las versiones 3.20.2, 3.19.6, 3.18.9, 3.17.15 y 3.16.18."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "GitHub",
          "product": "Enterprise Server",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "3.16.0",
              "lessThanOrEqual": "3.16.17",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.16.18",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.17.0",
              "lessThanOrEqual": "3.17.14",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.17.15",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.18.0",
              "lessThanOrEqual": "3.18.8",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.18.9",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.19.0",
              "lessThanOrEqual": "3.19.5",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.19.6",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.20.0",
              "lessThanOrEqual": "3.20.1",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.20.2",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-08T13:57:09.447908Z",
          "id": "CVE-2026-6736",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.16.18",
              "matchCriteriaId": "30904527-43B5-453A-A669-7845C2643965"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.17.0",
              "versionEndExcluding": "3.17.15",
              "matchCriteriaId": "D594E173-80DE-4EC9-9E6C-8C78A80D1402"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.18.0",
              "versionEndExcluding": "3.18.9",
              "matchCriteriaId": "2501EC91-4CD0-49F5-B76A-558EB5A5946C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.19.0",
              "versionEndExcluding": "3.19.6",
              "matchCriteriaId": "F2D6ABE3-EF68-4DDC-9846-9A891C859477"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.20.0",
              "versionEndExcluding": "3.20.2",
              "matchCriteriaId": "FC8A09E8-5FFE-43F1-BC1A-14A298264D80"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.16.18",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.17.15",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.18.9",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.19.6",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.20.2",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    }
  ]
}