CVE-2026-9132: CWE-862 Missing Authorization in GitHub Enterprise Server
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program.
AI Analysis
Technical Summary
A missing authorization vulnerability (CWE-862) in GitHub Enterprise Server's Copilot pull request description diff summary endpoint allowed an authenticated user with read access to at least one repository to read source code from private repositories they did not have access to. The endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying authorization on the target repository. This vulnerability affected all versions prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. The vulnerability was reported through the GitHub Bug Bounty program.
Potential Impact
An authenticated user with read access to any repository on the GitHub Enterprise Server instance could read source code from private repositories they were not authorized to access. This could lead to unauthorized disclosure of sensitive source code. There are no known exploits in the wild as of the publication date.
Mitigation Recommendations
This vulnerability has been fixed in GitHub Enterprise Server versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. Users should upgrade to one of these fixed versions or later to remediate the issue. Patch status is confirmed by the vendor advisory information. No additional mitigations are indicated.
CVE-2026-9132: CWE-862 Missing Authorization in GitHub Enterprise Server
Description
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS v4.0
Score 6.0medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A missing authorization vulnerability (CWE-862) in GitHub Enterprise Server's Copilot pull request description diff summary endpoint allowed an authenticated user with read access to at least one repository to read source code from private repositories they did not have access to. The endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying authorization on the target repository. This vulnerability affected all versions prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. The vulnerability was reported through the GitHub Bug Bounty program.
Potential Impact
An authenticated user with read access to any repository on the GitHub Enterprise Server instance could read source code from private repositories they were not authorized to access. This could lead to unauthorized disclosure of sensitive source code. There are no known exploits in the wild as of the publication date.
Mitigation Recommendations
This vulnerability has been fixed in GitHub Enterprise Server versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. Users should upgrade to one of these fixed versions or later to remediate the issue. Patch status is confirmed by the vendor advisory information. No additional mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_P
- Date Reserved
- 2026-05-20T18:18:07.930Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a442fed27e9c7971964744d
Added to database: 06/30/2026, 21:06:53 UTC
Last enriched: 07/08/2026, 12:34:20 UTC
Last updated: 08/15/2026, 00:41:15 UTC
Views: 139
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.