An incorrect authorization vulnerability (CWE-863) in GitHub Enterprise Server allowed user-to-server tokens scoped to GitHub App installations to perform certain write operations on public repositories beyond their intended scope. The authorization logic only checked if the installation had read permissions on the target repository, failing to verify explicit access for the token's installation. This permitted attackers who obtained a victim's token to create issues, issue comments, commit comments, and private vulnerability reports on any public repository, impersonating the victim user without indication of app involvement. The vulnerability affects all versions prior to 3.22 and was fixed by adding a repository scope check for user-to-server tokens issued by global apps. Fixed versions include 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20.

An attacker with access to a victim's user-to-server token could perform unauthorized write operations on any public repository, including creating issues, comments, and private vulnerability reports. These actions would appear as if performed by the victim user, with no indication of GitHub App involvement. This could lead to unauthorized modifications and potential misinformation or abuse of repository issue tracking and vulnerability reporting features.

This vulnerability has been fixed in GitHub Enterprise Server versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20 by adding repository scope checks for user-to-server tokens issued by global apps. Users should upgrade affected GitHub Enterprise Server instances to one of these fixed versions or later. Patch status is confirmed by the vendor advisory. No additional mitigations are indicated.