A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete… (CVE-2026-103620)

CVE-2026-103620 describes a missing authorization vulnerability in GitHub Enterprise Server where a repository collaborator with write access could delete the current default branch using the GraphQL API. This action allowed the attacker to promote a branch they controlled as the new default branch. In repositories that required pull-request review but did not restrict branch deletion, this bypassed the review process, causing fresh clones and default-branch API requests to use attacker-controlled content. The vulnerability affected supported releases in the 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.18.16, 3.19.13, 3.20.9, 3.21.7, and 3.22.2. The issue was reported through the GitHub Bug Bounty program.

The vulnerability allows an attacker with write access to a repository to delete the default branch and replace it with a branch they control, bypassing pull-request review requirements in certain configurations. This can lead to users cloning or interacting with attacker-controlled code, potentially undermining code integrity and trust. There is no impact on confidentiality or availability reported. The CVSS score is 6.5 (medium severity), reflecting the integrity impact without confidentiality or availability loss.

This vulnerability has been fixed in GitHub Enterprise Server versions 3.18.16, 3.19.13, 3.20.9, 3.21.7, and 3.22.2. Users should upgrade to these or later versions to remediate the issue. Since this is an on-premises product, administrators must apply these updates. No additional mitigation steps are indicated in the advisory.