CVE-2026-9132
Full vulnerability record from the local CVENow database.
Description
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program.
Severity
MEDIUM
CVSS score
6.0
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-30 21:16:30.960000
Last modified
2026-10-25 21:10:00.770000
View original CVE JSON
{
"id": "CVE-2026-9132",
"sourceIdentifier": "[email protected]",
"published": "2026-06-30T21:16:30.960",
"lastModified": "2026-10-25T21:10:00.770",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The\n Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view\n the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all\n versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program."
},
{
"lang": "es",
"value": "Una vulnerabilidad de autorización faltante fue identificada en GitHub Enterprise Server que permitía a un usuario autenticado leer código fuente de repositorios privados a los que no tenía acceso. El endpoint de resumen de diferencias de la descripción de solicitudes de extracción de Copilot aceptaba un rango de comparación entre repositorios y renderizaba la diferencia resultante sin verificar que el usuario solicitante estuviera autorizado para ver el repositorio de destino. La explotación requería una cuenta autenticada en la instancia con acceso de lectura a al menos un repositorio para usar como base de comparación. Esta vulnerabilidad afectaba a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y fue corregida en las versiones 3.17.17, 3.18.11, 3.19.8 y 3.20.4. Esta vulnerabilidad fue reportada a través del programa de recompensas por errores de GitHub."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "GitHub",
"product": "Enterprise Server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.17.0",
"lessThanOrEqual": "3.17.16",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.17.17",
"status": "unaffected"
}
]
},
{
"version": "3.18.0",
"lessThanOrEqual": "3.18.10",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.18.11",
"status": "unaffected"
}
]
},
{
"version": "3.19.0",
"lessThanOrEqual": "3.19.7",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.19.8",
"status": "unaffected"
}
]
},
{
"version": "3.20.0",
"lessThanOrEqual": "3.20.3",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.20.4",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-01T15:37:41.106015Z",
"id": "CVE-2026-9132",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.17.17",
"matchCriteriaId": "2EBDB435-5723-482A-8F7F-9A8987D76B4A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.0",
"versionEndExcluding": "3.18.11",
"matchCriteriaId": "0553891C-ED0B-4D2C-A832-29996F0CE8B2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.19.0",
"versionEndExcluding": "3.19.8",
"matchCriteriaId": "E67B4A61-E777-4B50-8DFC-DDF6292C4771"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.20.0",
"versionEndExcluding": "3.20.4",
"matchCriteriaId": "A51E85E4-FF55-497C-A39F-F69E224E63BD"
}
]
}
]
}
],
"references": [
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.17.17-features",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.18.11-features",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.19.8-features",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.20.4-features",
"source": "[email protected]",
"tags": [
"Release Notes"
]
}
]
}