CVE-2026-3306: GitHub Enterprise Server Auth Bypass Flaw

CVE-2026-3306 Overview

An improper authorization vulnerability was identified in GitHub Enterprise Server that allows users with read access to a repository and write access to a project to modify issue and pull request metadata through the project interface without proper permission verification. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions, enabling unauthorized modification of repository metadata.

Critical Impact

Attackers with limited repository access can bypass authorization controls to modify issue and pull request metadata, potentially disrupting project workflows, altering issue tracking data, and compromising the integrity of development processes.

Affected Products

• GitHub Enterprise Server versions prior to 3.14.24
• GitHub Enterprise Server versions prior to 3.15.19
• GitHub Enterprise Server versions prior to 3.16.15
• GitHub Enterprise Server versions prior to 3.17.12
• GitHub Enterprise Server versions prior to 3.18.6
• GitHub Enterprise Server versions prior to 3.19.3

Discovery Timeline

• 2026-03-10 - CVE-2026-3306 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3306

Vulnerability Analysis

This vulnerability represents an authorization bypass flaw (CWE-639: Authorization Bypass Through User-Controlled Key) in GitHub Enterprise Server's project management functionality. The core issue lies in the insufficient permission validation when users interact with project items that reference existing repository issues or pull requests.

When a user with read-only access to a repository but write access to an associated project attempts to add or manipulate items, the system fails to properly verify that the user has the necessary write permissions on the underlying repository before allowing metadata modifications. This creates a privilege escalation scenario where users can perform unauthorized write operations on repository data through the project interface.

The vulnerability is network-accessible and requires low privileges (read access to the repository plus write access to a project), making it exploitable by authenticated users with limited permissions. The impact is primarily on data integrity, as attackers can manipulate issue and pull request metadata including labels, milestones, assignees, and custom field values.

Root Cause

The root cause of CVE-2026-3306 is improper authorization checking in the code path that handles project item updates. When an item is added to a project that already exists in the system, the authorization logic only validates the user's project-level permissions without confirming that the user has write access to the associated repository. This oversight allows the column value updates to be applied without the required repository write permissions, effectively bypassing the intended access control model.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an authenticated attacker with:

1. Read access to the target repository
2. Write access to a project that references items from that repository

The attacker can exploit this vulnerability by adding existing issues or pull requests to a project they have write access to, then modifying the column values associated with those items. The system processes these modifications without verifying repository-level write permissions, allowing unauthorized changes to issue and pull request metadata.

The vulnerability mechanism involves manipulating the project interface to update repository item metadata. When a project item referencing an existing issue or pull request is modified, the system fails to re-validate the actor's write permissions on the source repository, allowing the unauthorized changes to persist. For detailed technical information, refer to the GitHub Enterprise Server Release Notes.

Detection Methods for CVE-2026-3306

Indicators of Compromise

• Unexpected modifications to issue or pull request metadata (labels, milestones, assignees, custom fields) by users who should only have read access
• Audit log entries showing project-based updates to repository items by users without repository write permissions
• Anomalous patterns of project item additions followed by immediate metadata changes

Detection Strategies

• Review GitHub Enterprise Server audit logs for actions where users with read-only repository access are modifying issue or pull request metadata through project interfaces
• Implement alerting on metadata changes to critical repositories where the actor's repository-level permissions don't include write access
• Monitor for patterns of users adding items to projects and immediately modifying field values, especially for repositories where they lack write access

Monitoring Recommendations

• Enable comprehensive audit logging for all project and repository actions in GitHub Enterprise Server
• Configure alerts for any metadata modifications on sensitive repositories
• Periodically review user permissions across projects and repositories to identify potential authorization inconsistencies
• Monitor for unusual patterns of project activity from users with limited repository access

How to Mitigate CVE-2026-3306

Immediate Actions Required

• Upgrade GitHub Enterprise Server to a patched version immediately: 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, or 3.19.3
• Review audit logs for any suspicious project-based modifications to repository items that may indicate exploitation
• Audit project permissions to ensure users with project write access are appropriately authorized for associated repositories
• Consider temporarily restricting project write access for users who only have repository read access until patching is complete

Patch Information

GitHub has released patches addressing this vulnerability across all supported GitHub Enterprise Server version branches. Organizations should update to one of the following patched versions:

This vulnerability was reported via the GitHub Bug Bounty program.

Workarounds

• Restrict project write access to users who also have write access to associated repositories
• Implement organizational policies requiring matching permission levels between projects and linked repositories
• Use repository branch protection and required reviews to detect unauthorized metadata changes
• Consider temporarily disabling the ability to link projects to repositories containing sensitive data until patching is applied

# Verify current GitHub Enterprise Server version
ghe-version

# Check for available updates
ghe-update-check

# Apply the security update
ghe-upgrade <package-path-to-patched-version>