Missing Authorization Vulnerability in GitHub Enterprise Server

CVE-2026-1355

What is CVE-2026-1355?

A critical vulnerability exists in GitHub Enterprise Server allowing unauthorized content uploads to another user’s repository migration export. This occurs due to a missing authorization check within the migration upload endpoint. An attacker could exploit this flaw by supplying the migration identifier, leading to overwriting or replacing a victim's migration archive. This poses a risk of users downloading malicious repository data during migration restores or automated imports, assuming the attacker has authenticated access to the victim's instance. Affected users are encouraged to update to the fixed versions to mitigate this risk.

References