CVE-2026-103620
Github Enterprise Server: missing authorisation
- Risk score
- 47/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required pull-request review but…
- Affected
- Github Enterprise Server before 3.18.16, 3.19.13, 3.20.9, 3.21.7, 3.22.2
- Fix
- Upgrade Github Enterprise Server to 3.18.16, 3.19.13, 3.20.9, 3.21.7 or 3.22.2 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Story map
At a glance
Github Enterprise Server: Amber, patch this week. A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for…
The flaws
- CVE-2026-103620: Missing authorisation (CVSS 6.5 · EPSS 0%)
- CVE-2026-96890: Server-side request forgery can lead to remote code execution (CVSS 8.8 · EPSS 0%)
The fix
Upgrade Github Enterprise Server: 3.18.16 · 3.19.13 · 3.20.9 · 3.21.7 · 3.22.2 or later on your release line
Who is exposed: Github Enterprise Server before 3.20.9, 3.21.7, 3.22.2
Where it stands
- No known exploitation
Connects to
- Same weakness: Missing authorisation (CWE-862). 399 other warnings in 30 days
Why it is Yellow
- CVSS 6.5 medium
References
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.16
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.13
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.9
- https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.7
- https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.2
Original description
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required pull-request review but did not restrict branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content. This vulnerability affected supported GitHub Enterprise Server releases in the 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.18.16, 3.19.13, 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported via the GitHub Bug Bounty program.
Last activity 6 Oct 2026. Patch Forecast updates every hour.