Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens

CVE-2022-23739

Summary

An incorrect authorization vulnerability was discovered in GitHub Enterprise Server that enables privilege escalation through GraphQL API requests made by GitHub Apps. This issue allows an installed app in an organization to access and alter various organization-level resources independently of the provided permissions. Notably, resources tied to repositories—like repository contents, specific projects, issues, and pull requests—remained unaffected. All versions prior to 3.7.1 are susceptible to this vulnerability, which has been addressed in versions 3.3.16, 3.4.11, 3.5.8, 3.6.4, and 3.7.1 as part of GitHub's commitment to security.

References