CVE-2026-3582CWE-862

Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope

Medium · published March 10, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00418 · 35.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-03-10T18:56Z
EPSS history
Timeline
  • 10 MAR 18:56Z
    Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope
    cvelistv5