CVE-2026-1355: GitHub Enterprise Server Auth Bypass Flaw

CVE-2026-1355 Overview

A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user's repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim's migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance.

Critical Impact

Authenticated attackers can overwrite victim migration archives with malicious content, enabling supply chain attacks through compromised repository imports.

Affected Products

• GitHub Enterprise Server versions prior to 3.20
• GitHub Enterprise Server versions prior to 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23
• All GitHub Enterprise Server installations with repository migration features enabled

Discovery Timeline

• February 18, 2026 - CVE-2026-1355 published to NVD
• February 19, 2026 - Last updated in NVD database

This vulnerability was reported via the GitHub Bug Bounty program.

Technical Details for CVE-2026-1355

Vulnerability Analysis

This vulnerability stems from CWE-862 (Missing Authorization), a critical access control weakness where the application fails to verify that a user has the necessary permissions before allowing access to a protected resource or functionality. In this case, the repository migration upload endpoint accepts migration identifiers without validating whether the authenticated user owns or has permission to modify that specific migration.

The attack scenario enables authenticated users to hijack other users' migration exports by supplying arbitrary migration identifiers. When victims subsequently download or restore these compromised migration archives, they unknowingly import attacker-controlled repository data. This creates a significant integrity impact, as malicious code, backdoors, or compromised dependencies could be injected into the victim's development workflow.

Root Cause

The root cause is a missing authorization check in the repository migration upload endpoint. The endpoint accepts and processes migration upload requests based solely on the migration identifier provided in the request, without verifying that the authenticated user is the owner of that migration or has explicit permission to modify it. This breaks the principle of least privilege and allows any authenticated user to tamper with migrations belonging to other users.

Attack Vector

The attack requires network access and authentication to the target GitHub Enterprise Server instance. An attacker must:

1. Obtain valid authentication credentials to the GitHub Enterprise Server instance
2. Identify or enumerate valid migration identifiers belonging to target victims
3. Upload malicious repository content to the migration upload endpoint using the victim's migration identifier
4. Wait for the victim to restore or import their compromised migration archive

The vulnerability is particularly dangerous in enterprise environments where migration operations may be automated through CI/CD pipelines or scheduled scripts, as the malicious content would be imported without manual inspection. The attack could enable supply chain compromise by injecting backdoored code, malicious dependencies, or compromised configurations into victim repositories.

Detection Methods for CVE-2026-1355

Indicators of Compromise

• Unexpected or unauthorized uploads to repository migration endpoints by users who do not own the migration
• Migration archive checksums that do not match expected values after upload operations
• Audit log entries showing migration upload requests with migration identifiers belonging to different users
• Anomalous repository content appearing after migration restore operations

Detection Strategies

• Monitor GitHub Enterprise Server audit logs for migration upload events and correlate with migration ownership
• Implement alerting on migration upload requests where the authenticated user does not match the migration owner
• Review repository content integrity after migration restores, especially for automated import workflows
• Audit user permissions and access patterns related to migration endpoints

Monitoring Recommendations

• Enable comprehensive audit logging for all repository migration operations
• Implement integrity verification for migration archives before restoration
• Configure alerts for unusual patterns in migration API usage across user accounts
• Review automated migration scripts and CI/CD pipelines for potential exposure to compromised archives

How to Mitigate CVE-2026-1355

Immediate Actions Required

• Upgrade GitHub Enterprise Server to patched versions: 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, or 3.14.23
• Audit recent migration operations for signs of unauthorized uploads or tampering
• Verify integrity of any recently restored migration archives
• Review audit logs for suspicious migration upload activity across different user accounts

Patch Information

GitHub has released security patches across multiple supported branches of GitHub Enterprise Server. Organizations should upgrade to one of the following fixed versions based on their current branch:

• Version 3.19.2 - GitHub Enterprise Release Notes 3.19.2
• Version 3.18.5 - GitHub Enterprise Release Notes 3.18.5
• Version 3.17.11 - GitHub Enterprise Release Notes 3.17.11
• Version 3.16.14 - GitHub Enterprise Release Notes 3.16.14
• Version 3.15.18 - GitHub Enterprise Release Notes 3.15.18
• Version 3.14.23 - GitHub Enterprise Release Notes 3.14.23

Upgrading to version 3.20 or later is recommended to receive the latest security updates.

Workarounds

• Restrict access to repository migration features to only trusted administrators until patches can be applied
• Implement network-level controls to limit access to migration API endpoints
• Manually verify migration archive integrity using checksums before restoring
• Temporarily disable automated migration restore workflows until the environment is patched

# Verify GitHub Enterprise Server version
ghe-config --get 'core.package-version'

# Check audit logs for migration activity (example query)
ghe-support-bundle --category audit-log | grep -i "migration"