CVE-2021-22863: Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests
An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.12.22 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-22863?
CVE-2021-22863 is an improper access control vulnerability identified in the GitHub Enterprise Server GraphQL API.
What is the severity of CVE-2021-22863?
The severity of CVE-2021-22863 is high with a CVSS score of 8.1.
How does CVE-2021-22863 affect GitHub Enterprise Server?
CVE-2021-22863 affects GitHub Enterprise Server versions from 2.12.22 to 2.20.24, versions from 2.21.0 to 2.21.15, and versions from 2.22.0 to 2.22.7.
What can an attacker do by exploiting CVE-2021-22863?
By exploiting CVE-2021-22863, an attacker can modify the maintainer collaboration permission of a pull request without proper authorization.
How can I fix CVE-2021-22863?
To fix CVE-2021-22863, update your GitHub Enterprise Server to the recommended versions: 2.20.24, 2.21.15, or 2.22.7.