Improper Authorization in GitHub Enterprise Server

CVE-2026-3306

What is CVE-2026-3306?

An improper authorization vulnerability in GitHub Enterprise Server permits users with read access to a repository and write access to a project to alter issue and pull request metadata without appropriate verification of their repository permissions. This flaw allows alterations to project items, enabling users to apply updates indiscriminately. The vulnerability was disclosed via the GitHub Bug Bounty program and has been remedied in various versions of GitHub Enterprise Server, ensuring enhanced security measures.

References