An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw… (CVE-2026-75101)
An authorization bypass vulnerability in GitHub Enterprise Server allowed any authenticated user to read raw diffs or patches of pull requests in private repositories without proper authorization. The issue stemmed from access tokens being scoped to repository name and pull request number rather than a globally unique repository identifier. This enabled an attacker who created a repository and pull request with matching names and numbers to access private pull request contents. The vulnerability affected all versions prior to 3.22 and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. Exploitation required knowledge of the target repository name and a valid pull request number. The CVSS score is 6.5 (medium severity).
AI Analysis
Technical Summary
CVE-2026-75101 is an authorization bypass vulnerability in GitHub Enterprise Server where access tokens for raw pull request diffs and patches were scoped to repository name and pull request number rather than a globally unique repository identifier. This flaw allowed any authenticated user to create a repository and pull request with matching names and numbers to a target's private repository and pull request, and use their own token to retrieve the private pull request's raw diff or patch. The vulnerability affected all versions prior to 3.22 and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. Exploitation requires knowledge of the target repository name and pull request number. The vulnerability was responsibly disclosed via the GitHub Bug Bounty program.
Potential Impact
An attacker with any authenticated access to a GitHub Enterprise Server instance could bypass authorization controls to read raw diffs or patches of pull requests in private repositories. This exposure could lead to unauthorized disclosure of potentially sensitive code changes. The vulnerability does not impact integrity or availability, only confidentiality.
Mitigation Recommendations
This vulnerability has been fixed in GitHub Enterprise Server versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. Users should upgrade to one of these fixed versions or later to remediate the issue. No other mitigation is required once patched.
An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw… (CVE-2026-75101)
Description
An authorization bypass vulnerability in GitHub Enterprise Server allowed any authenticated user to read raw diffs or patches of pull requests in private repositories without proper authorization. The issue stemmed from access tokens being scoped to repository name and pull request number rather than a globally unique repository identifier. This enabled an attacker who created a repository and pull request with matching names and numbers to access private pull request contents. The vulnerability affected all versions prior to 3.22 and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. Exploitation required knowledge of the target repository name and a valid pull request number. The CVSS score is 6.5 (medium severity).
CVSS v3.1
Score 6.5medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-75101 is an authorization bypass vulnerability in GitHub Enterprise Server where access tokens for raw pull request diffs and patches were scoped to repository name and pull request number rather than a globally unique repository identifier. This flaw allowed any authenticated user to create a repository and pull request with matching names and numbers to a target's private repository and pull request, and use their own token to retrieve the private pull request's raw diff or patch. The vulnerability affected all versions prior to 3.22 and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. Exploitation requires knowledge of the target repository name and pull request number. The vulnerability was responsibly disclosed via the GitHub Bug Bounty program.
Potential Impact
An attacker with any authenticated access to a GitHub Enterprise Server instance could bypass authorization controls to read raw diffs or patches of pull requests in private repositories. This exposure could lead to unauthorized disclosure of potentially sensitive code changes. The vulnerability does not impact integrity or availability, only confidentiality.
Mitigation Recommendations
This vulnerability has been fixed in GitHub Enterprise Server versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. Users should upgrade to one of these fixed versions or later to remediate the issue. No other mitigation is required once patched.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-843p-hf47-6r9f
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-75101"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac139c3a43b0b3b89d69d66
Added to database: 10/03/2026, 17:22:11 UTC
Last enriched: 10/03/2026, 17:44:07 UTC
Last updated: 10/03/2026, 23:41:58 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.