CVE-2026-1355 is a missing authorization vulnerability (CWE-862) identified in GitHub Enterprise Server, affecting all versions prior to 3.20. The flaw exists in the repository migration upload endpoint, where an attacker with authenticated access but limited privileges can supply a migration identifier to upload unauthorized content to another user’s repository migration export. This lack of proper authorization checks enables the attacker to overwrite or replace the victim’s migration archive. Consequently, when the victim performs migration restores or automated imports, they may unknowingly download and use attacker-controlled repository data, potentially compromising code integrity and trust. The vulnerability requires authentication but no additional user interaction, and the attack complexity is low due to the missing authorization check. The issue was responsibly disclosed via the GitHub Bug Bounty program and fixed in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, and 3.14.23. The CVSS v4.0 base score is 6.0 (medium severity), reflecting network attack vector, low attack complexity, and partial impact on integrity with no impact on confidentiality or availability. No known exploits have been reported in the wild, but the vulnerability poses a risk to the integrity of repository data during migration processes.

For European organizations, this vulnerability can undermine the integrity of critical source code and project data managed within GitHub Enterprise Server. Organizations relying on migration exports for backup, disaster recovery, or migration to new instances risk importing malicious or tampered code, which could introduce backdoors, vulnerabilities, or sabotage software supply chains. This can lead to compromised software products, intellectual property theft, or reputational damage. Since the vulnerability requires authentication, insider threats or compromised credentials pose a significant risk. The impact is particularly severe for organizations with strict compliance requirements around software integrity and provenance, such as those in finance, healthcare, and critical infrastructure sectors prevalent in Europe. Additionally, the disruption of development workflows and the potential need for forensic analysis and remediation could incur operational costs and delays.

European organizations should immediately verify their GitHub Enterprise Server versions and upgrade to the fixed releases (3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, or 3.14.23) to remediate this vulnerability. Beyond patching, organizations should enforce strict access controls and monitor repository migration activities for anomalies, such as unexpected migration exports or uploads. Implement multi-factor authentication (MFA) to reduce the risk of credential compromise. Regularly audit user permissions to ensure least privilege principles are applied, especially for users with migration capabilities. Employ logging and alerting on migration endpoints to detect unauthorized attempts. Consider isolating migration operations to dedicated environments or time windows with enhanced monitoring. Finally, educate development and DevOps teams about the risks of repository migration tampering and encourage prompt reporting of suspicious activities.