Authorization Bypass in GitHub Enterprise Server

CVE-2026-3307

What is CVE-2026-3307?

An authorization bypass flaw was discovered in GitHub Enterprise Server, enabling an administrator of one repository to alter the secret scanning push protection bypass reviewer list of another repository by manipulating the owner_id parameter in the request. Although the vulnerability is limited to the reassignment of existing trusted users as bypass reviewers, it does not permit the addition of unauthorized external users. All versions prior to 3.21 are affected, and the issue was resolved in specified later versions following a report through the GitHub Bug Bounty program.

References