CVE-2026-9106
Full vulnerability record from the local CVENow database.
Description
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
Severity
MEDIUM
CVSS score
4.8
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-30 21:16:30.803000
Last modified
2026-10-25 21:10:00.770000
View original CVE JSON
{
"id": "CVE-2026-9106",
"sourceIdentifier": "[email protected]",
"published": "2026-06-30T21:16:30.803",
"lastModified": "2026-10-25T21:10:00.770",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program."
},
{
"lang": "es",
"value": "Se identificó una vulnerabilidad de tergiversación de la interfaz de usuario en GitHub Enterprise Server que permitía a una aplicación OAuth obtener acceso no intencionado a la gestión de ejecutores de una organización. Un atacante podría explotar esto creando una aplicación OAuth que solicitara el ámbito manage_runners:org y dirigiendo a un usuario víctima para que la autorizara, ya que el ámbito no se mostraba en la pantalla de consentimiento de autorización. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.22 y se corrigió en las versiones 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. Esta vulnerabilidad fue reportada a través del programa GitHub Bug Bounty."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "GitHub",
"product": "Enterprise Server",
"defaultStatus": "affected",
"versions": [
{
"version": "3.17.0",
"lessThanOrEqual": "3.17.16",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.17.17",
"status": "unaffected"
}
]
},
{
"version": "3.18.0",
"lessThanOrEqual": "3.18.10",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.18.11",
"status": "unaffected"
}
]
},
{
"version": "3.19.0",
"lessThanOrEqual": "3.19.7",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.19.8",
"status": "unaffected"
}
]
},
{
"version": "3.20.0",
"lessThanOrEqual": "3.20.3",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.20.4",
"status": "unaffected"
}
]
},
{
"version": "3.21.0",
"lessThanOrEqual": "3.21.1",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.21.2",
"status": "unaffected"
}
]
},
{
"version": "3.16.0",
"lessThanOrEqual": "3.16.19",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.16.20",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.1,
"impactScore": 3.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-01T15:37:19.373936Z",
"id": "CVE-2026-9106",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-451"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.16.20",
"matchCriteriaId": "09FDB053-8EF5-4CAF-9C05-090985C57A77"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.17.0",
"versionEndExcluding": "3.17.17",
"matchCriteriaId": "F0612BD3-C04E-4A34-ACEF-4D1F4F723E47"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.0",
"versionEndExcluding": "3.18.11",
"matchCriteriaId": "0553891C-ED0B-4D2C-A832-29996F0CE8B2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.19.0",
"versionEndExcluding": "3.19.8",
"matchCriteriaId": "E67B4A61-E777-4B50-8DFC-DDF6292C4771"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.20.0",
"versionEndExcluding": "3.20.4",
"matchCriteriaId": "A51E85E4-FF55-497C-A39F-F69E224E63BD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.21.0",
"versionEndExcluding": "3.21.2",
"matchCriteriaId": "051B2085-DBF2-420B-B356-70C0AB2D97C7"
}
]
}
]
}
],
"references": [
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.16.20",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.17.17",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.18.11",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.19.8",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.20.4",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.21.2",
"source": "[email protected]",
"tags": [
"Release Notes"
]
}
]
}