Authorization Bypass in GitHub Enterprise Server

CVE-2026-75101

What is CVE-2026-75101?

An authorization bypass vulnerability was discovered in GitHub Enterprise Server, enabling authenticated users to access the raw diff or patch of pull requests in private repositories without proper authorization. The issue stemmed from the access tokens being linked to repository names and pull request numbers instead of unique identifiers. As a result, an attacker could potentially create a repository that matched a target's repository name and pull request number to exploit this flaw. To successfully exploit this vulnerability, an attacker needed to know the target repository's name and a valid pull request number. The vulnerability impacts all earlier versions of GitHub Enterprise Server, and patches were released in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6.

References