Improper Authorization Vulnerability in GitHub Enterprise Server

CVE-2026-5512

What is CVE-2026-5512?

An improper authorization vulnerability exists within GitHub Enterprise Server that enables authenticated attackers to discover the names of private repositories using their numeric IDs. The mobile upload policy API endpoint fails to conduct an early authorization check, potentially exposing details through validation error messages that include complete repository names, even when access is not granted. This security flaw affects multiple versions of GitHub Enterprise Server prior to version 3.21 and was disclosed through the GitHub Bug Bounty program.

References