CVE-2026-14340: GitHub Enterprise Server Auth Bypass Bug

CVE-2026-14340 Overview

CVE-2026-14340 is an incorrect authorization vulnerability [CWE-863] in GitHub Enterprise Server. The flaw allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. The authorization check only verified that the installation had read permissions on the target repository. It did not verify that the token's installation was explicitly granted access to that repository. GitHub fixed the issue by adding a repository scope check for user-to-server tokens issued by global apps. The vulnerability was reported through the GitHub Bug Bounty program.

Critical Impact
An attacker who obtained a victim's user-to-server token could create issues, issue comments, commit comments, and private vulnerability reports on any public repository, appearing as the victim user with no indication of the app's involvement.

Affected Products

GitHub Enterprise Server versions prior to 3.16.20
GitHub Enterprise Server 3.17.x prior to 3.17.17, 3.18.x prior to 3.18.11, 3.19.x prior to 3.19.8
GitHub Enterprise Server 3.20.x prior to 3.20.4 and 3.21.x prior to 3.21.2

Discovery Timeline

2026-07-01 - CVE-2026-14340 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14340

Vulnerability Analysis

GitHub Apps can act on behalf of users through user-to-server tokens. These tokens are scoped to a specific installation, which defines the repositories the app can access. GitHub Enterprise Server failed to enforce this repository scoping correctly for write operations against public repositories. The server confirmed that the installation held read permissions on the target repository but skipped the check that ties the token's installation to explicit access on that repository. As a result, the token could write content to public repositories the installation was never granted.

Successful abuse allowed the attacker to create issues, issue comments, commit comments, and private vulnerability reports as the victim user. The activity carried no indication of the GitHub App's involvement, so audit trails and repository maintainers saw only the victim's identity. This creates opportunities for social engineering, false vulnerability reports, and reputation abuse across public repositories on the instance.

Root Cause

The root cause is a missing authorization check on the token's installation-to-repository binding. The code path evaluated whether the installation had generic read permission on the target repository rather than whether the specific installation was granted access. This is a classic incorrect authorization pattern captured by [CWE-863].

Attack Vector

Exploitation requires the attacker to first obtain a victim's user-to-server token, then send authenticated API requests to public repositories outside the installation's granted scope. The attack is network-based and requires low privileges (a valid token). No user interaction is required to trigger the write operations. See the GitHub Enterprise Server 3.21.2 release notes for the vendor description of the fix.

Detection Methods for CVE-2026-14340

Indicators of Compromise

Issues, issue comments, commit comments, or private vulnerability reports created by a user account on public repositories where the associated GitHub App installation was not explicitly granted access.
API access log entries showing user-to-server token authentication against repositories outside the installation's configured scope.
Unexpected activity from user accounts that recently authorized a third-party GitHub App.

Detection Strategies

Audit GitHub Enterprise Server API logs for user-to-server token requests targeting repositories not listed in the installation's repository selection.
Correlate repository write events (issues.create, issue_comment.create, commit_comment.create, repository_vulnerability_report.create) with the calling installation ID and compare against the installation's granted repository set.
Review GitHub App installation change history for users who authorized apps prior to patching.

Monitoring Recommendations

Ingest GitHub Enterprise Server audit logs into a centralized SIEM or data lake and alert on write operations authored by user-to-server tokens on out-of-scope repositories.
Track newly created issues and private vulnerability reports on public repositories for anomalous authors and content patterns.
Monitor GitHub App authorization grants and revocations for user accounts with elevated visibility.

How to Mitigate CVE-2026-14340

Immediate Actions Required

Upgrade GitHub Enterprise Server to a fixed release: 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, or 3.16.20.
Review installed GitHub Apps and revoke any that are unnecessary or untrusted, then rotate user-to-server tokens tied to those apps.
Audit recent write activity on public repositories for content posted through user-to-server tokens outside expected installation scopes.

Patch Information

GitHub fixed CVE-2026-14340 by adding a repository scope check for user-to-server tokens issued by global apps. Fixed versions are 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20. All GitHub Enterprise Server versions prior to 3.22 are affected. Refer to the vendor release notes: 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.2.

Workarounds

No vendor-published workaround exists; applying the patched release is the supported remediation.
As an interim risk-reduction step, restrict GitHub App installations on the instance and require administrator approval for new user authorizations.
Rotate or revoke existing user-to-server tokens for GitHub Apps that users no longer use.

bash

# Verify the running GitHub Enterprise Server version
ghe-version

# Example upgrade path using the CLI (run as admin on the appliance)
# Replace the package URL with the fixed release relevant to your version line
ghe-upgrade /path/to/github-enterprise-<fixed-version>.pkg