This vulnerability in GitHub Enterprise Server (CVE-2026-15783) involves missing authorization checks in a delegated bypass endpoint. Authenticated users with write access to any repository could exploit this flaw to enumerate and read metadata from private repositories they do not have access to. The vulnerability arises because the endpoint resolved rule suites directly from attacker-supplied sequential encoded identifiers without verifying read permissions on the associated repositories. This allowed unauthorized disclosure of private repository metadata such as owners, names, branch names, commit SHAs, commit messages, and pushing actors. The issue affects all versions prior to 3.22 and was fixed in versions 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3.

An authenticated user with write access to any repository on the affected GitHub Enterprise Server instance could access metadata from private repositories they do not have permission to view. This metadata includes sensitive information such as private repository owners, repository names, branch names, commit SHAs, commit messages, and the identity of the pushing actor. While this does not grant full repository access or code disclosure, it leaks confidential metadata that could aid further reconnaissance or targeted attacks.

This vulnerability has been fixed in GitHub Enterprise Server versions 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3. Users should upgrade affected instances to one of these fixed versions or later. Since this is an on-premises product, administrators must apply the official patches to remediate the issue. Patch status is confirmed by the vendor advisory embedded in the description. No additional mitigation steps are indicated.