CVE-2026-15783 Overview
CVE-2026-15783 is a missing authorization vulnerability in GitHub Enterprise Server (GHES) that allowed authenticated users with write access to any repository to read metadata from private repositories they did not have permission to access. Exposed metadata included private repository owners and names, branch names, commit SHAs, commit messages, and the pushing actor. The flaw resided in the delegated bypass endpoint, which resolved a rule suite directly from an attacker-supplied identifier without verifying repository read authorization. Because rule suite identifiers are sequential, an attacker could enumerate them across the entire instance. The issue was reported through the GitHub Bug Bounty program and is tracked under CWE-862: Missing Authorization.
Critical Impact
Any authenticated user with write access to a single repository could enumerate and read sensitive metadata from every private repository across the GHES instance.
Affected Products
- GitHub Enterprise Server, all versions prior to 3.17.18
- GitHub Enterprise Server 3.18.x prior to 3.18.12, 3.19.x prior to 3.19.9
- GitHub Enterprise Server 3.20.x prior to 3.20.5, and 3.21.x prior to 3.21.3
Discovery Timeline
- 2026-07-17 - CVE-2026-15783 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-15783
Vulnerability Analysis
The vulnerability arises in the delegated bypass endpoint used by GHES repository rule suites. This endpoint accepts an encoded identifier from the requesting user and resolves it to a rule suite object. The application then returns metadata associated with that rule suite, including details about the target repository and recent push activity.
The endpoint performs no authorization check to confirm that the caller has read permission on the repository the rule suite belongs to. Any authenticated user holding write access on at least one repository within the instance can invoke the endpoint successfully. The returned data reveals otherwise private repository ownership, naming, branching, and commit history metadata.
Root Cause
The root cause is a missing authorization check [CWE-862] on the delegated bypass endpoint. The handler resolves a rule suite from the supplied identifier and returns its associated data without validating whether the current user can access the underlying repository. Object-level authorization was implicitly assumed from session authentication rather than enforced per resource.
Attack Vector
An authenticated user submits requests to the delegated bypass endpoint using encoded rule suite identifiers. Because these identifiers are assigned sequentially, the attacker iterates through the numeric space to enumerate every rule suite on the appliance. For each valid identifier, the response discloses private repository owner and name, branch names, commit SHAs, commit messages, and the actor who pushed each commit. No user interaction from repository owners is required, and the attack works entirely over the network against the GHES web interface.
No verified public exploit code is available. Refer to the GitHub Enterprise Server 3.21.3 release notes for vendor details.
Detection Methods for CVE-2026-15783
Indicators of Compromise
- Repeated authenticated requests to the delegated bypass rule suite endpoint from a single user or token within a short window.
- Sequential enumeration patterns in request logs targeting encoded rule suite identifiers.
- Access attempts to rule suite identifiers that resolve to repositories the requesting user has no membership or collaborator relationship with.
Detection Strategies
- Review GHES audit logs for high-volume access to rule suite bypass endpoints originating from accounts with limited repository scope.
- Correlate user permission scope against the set of repositories referenced in their rule suite API calls to surface cross-repository access anomalies.
- Baseline normal rule suite endpoint usage per user role and alert on statistical outliers.
Monitoring Recommendations
- Forward GHES audit and web request logs to a central analytics platform for retention and query.
- Build detection rules that flag enumeration behavior against sequential identifier ranges on internal APIs.
- Monitor for account compromise indicators on users with broad write access, since these accounts satisfy the precondition for exploitation.
How to Mitigate CVE-2026-15783
Immediate Actions Required
- Upgrade GitHub Enterprise Server to a fixed release: 3.17.18, 3.18.12, 3.19.9, 3.20.5, or 3.21.3.
- Audit rule suite endpoint access logs for the period preceding the upgrade to identify possible metadata exposure.
- Rotate any secrets or references that were embedded in commit messages of private repositories if enumeration is suspected.
Patch Information
GitHub released fixes in GHES 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3. All GHES versions prior to 3.22 without these patches remain vulnerable. Release details are available in the 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3 release notes.
Workarounds
- No vendor workaround is published; apply the patched release as the primary remediation.
- Restrict repository write access to the minimum set of users required to reduce the pool of accounts that could exploit the flaw prior to patching.
- Enforce short-lived tokens and mandatory multi-factor authentication to limit the impact of credential compromise on accounts with write permissions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
