Improper Authorization Vulnerability in GitHub Enterprise Server

CVE-2026-5845

What is CVE-2026-5845?

An improper authorization vulnerability exists in token authorization for scoped user-to-server interactions within GitHub Enterprise Server. This flaw enables an authenticated attacker to gain unauthorized access to private repositories, potentially allowing for write operations beyond the intended scope. The root cause involves an authorization fallback that treated a revoked or deleted installation as if it retained global installation privileges. This issue can be exploited in conjunction with token revocation timing and SSH push attribution, allowing misuse of tokens specific to a victim’s context. Affected versions include all prior to 3.21, with multiple fixes applied in subsequent versions.

References