CVE-2025-8447: Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8447?
CVE-2025-8447 has been categorized with a severity rating that indicates a risk of unauthorized code access between repositories.
How do I fix CVE-2025-8447?
To mitigate CVE-2025-8447, ensure you update GitHub Enterprise Server to a version that is patched for this vulnerability.
Who is affected by CVE-2025-8447?
CVE-2025-8447 affects users of GitHub Enterprise Server versions up to 3.18.
What is the nature of the vulnerability CVE-2025-8447?
CVE-2025-8447 is an improper access control vulnerability that permits limited code content retrieval across repositories.
Can CVE-2025-8447 be exploited remotely?
Yes, CVE-2025-8447 can potentially be exploited remotely by users with access to any affected repository.