CVE-2026-5845: Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server
An improper authorization vulnerability in scoped user-to-server (ghu) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context, which could be chained with token revocation timing and SSH push attribution to obtain and reuse a victim-scoped token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5845?
CVE-2026-5845 is considered a critical severity vulnerability due to its potential to allow unauthorized access to private repositories.
How do I fix CVE-2026-5845?
To mitigate CVE-2026-5845, upgrade GitHub Enterprise Server to version 3.21 or later.
Who is affected by CVE-2026-5845?
CVE-2026-5845 affects users of GitHub Enterprise Server versions prior to 3.21.
What type of vulnerability is CVE-2026-5845?
CVE-2026-5845 is an improper authorization vulnerability related to scoped user-to-server token installations.
What impact does CVE-2026-5845 have on GitHub Enterprise Server?
CVE-2026-5845 can allow authenticated attackers to access private repositories that they should not have permissions for.