An incorrect authorization vulnerability (CWE-863) in GitHub Enterprise Server allowed user-to-server tokens scoped to GitHub App installations to perform certain write operations on public repositories beyond their intended scope. The authorization check only verified that the installation had read permissions on the target repository rather than confirming explicit access for the token's installation. Consequently, an attacker who obtained a victim's token could create issues, issue comments, commit comments, and private vulnerability reports on any public repository, impersonating the victim user without indication of app involvement. This vulnerability affected all versions prior to 3.22 and was fixed by adding repository scope checks for user-to-server tokens issued by global apps. Fixed versions include 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20.

An attacker with access to a victim's user-to-server token could perform unauthorized write operations on any public repository, including creating issues and comments and submitting private vulnerability reports. These actions would appear as if performed by the victim user, without any indication of GitHub App involvement. This could lead to unauthorized repository modifications and potential reputational damage. The vulnerability does not affect private repositories or escalate privileges beyond the described scope.

This vulnerability has been fixed in GitHub Enterprise Server versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20. Users should upgrade to one of these fixed versions or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.