Improper Access Control in GitHub Enterprise Server

CVE-2025-8447

What is CVE-2025-8447?

An improper access control vulnerability discovered in GitHub Enterprise Server allows unauthorized users with access to any repository to retrieve limited code content from another repository. By leveraging the compare/diff functionality, an attacker must know the name of a private repository along with specific branches, tags, or commit SHAs to exploit this flaw. This security flaw impacts all versions of GitHub Enterprise Server before 3.18, which have been remedied in versions 3.14.17, 3.15.12, 3.16.8, and 3.17.5. Continuous vigilance and timely updates are crucial to safeguarding repository integrity.

References