CVE-2026-48529 describes an improper access control vulnerability (CWE-284) in GitHub MCP Server from versions 0.22.0 up to but not including 1.1.2. When operating in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. Subsequent requests from different users share this singleton, causing their lockdown-related GraphQL queries to execute using the first user's credentials. The singleton is never updated to reflect later users' tokens, leading to potential unauthorized access or privilege escalation within the lockdown context. The vulnerability is resolved in version 1.1.2.

The vulnerability allows subsequent users' requests to be executed with the credentials of the first authenticated user, potentially leading to unauthorized access or privilege escalation. The CVSS 3.1 base score is 6.0 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Upgrade GitHub MCP Server to version 1.1.2 or later where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Since this is not a cloud service, users must apply the patch themselves.