This vulnerability arises because authorization checks are performed against the repository specified in the URL, but the action is applied to a different repository specified in the request body. An attacker with admin rights on one repository can exploit this to modify the delegated bypass reviewer list on another repository by manipulating the owner_id parameter. The impact is limited to assigning existing trusted users as bypass reviewers, without the ability to add arbitrary external users. The flaw affects GitHub Enterprise Server versions before 3.21 and was addressed in versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, and 3.20.1. The vulnerability was responsibly disclosed via the GitHub Bug Bounty program.

An attacker with admin access on one repository can bypass authorization controls to modify the secret scanning push protection delegated bypass reviewer list on another repository. This could allow assigning trusted users as bypass reviewers on repositories where the attacker does not have admin rights. However, the attacker cannot add arbitrary external users, limiting the scope of potential misuse. The vulnerability could weaken secret scanning protections by altering reviewer assignments.

Fixed versions are available: 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, and 3.20.1. Users of affected GitHub Enterprise Server versions should upgrade to one of these patched releases to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patches.