CVE-2026-3582: GitHub Enterprise Server Auth Bypass Flaw

CVE-2026-3582 Overview

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allows an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. This authorization bypass could expose sensitive source code commit information and issue details to users who should not have direct repository access through API queries.

The vulnerability requires the attacker to already have existing access to the target repository through organization membership or as a collaborator, limiting the attack surface to insider threat scenarios. However, the ability to bypass PAT scope restrictions undermines the principle of least privilege that organizations rely on when distributing access tokens with limited capabilities.

Critical Impact

Authenticated users with limited-scope personal access tokens can access private repository issues and commits through the search REST API, bypassing intended authorization controls.

Affected Products

• GitHub Enterprise Server versions prior to 3.16.15
• GitHub Enterprise Server versions prior to 3.17.12
• GitHub Enterprise Server versions prior to 3.18.6
• GitHub Enterprise Server versions prior to 3.19.3
• All versions of GitHub Enterprise Server prior to 3.20

Discovery Timeline

• 2026-03-10 - CVE-2026-3582 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3582

Vulnerability Analysis

This vulnerability stems from CWE-862 (Missing Authorization), where the search REST API endpoints in GitHub Enterprise Server fail to properly validate the scope permissions of classic personal access tokens before returning repository content. When a user queries the search API for issues or commits, the authorization logic checks whether the user has organizational or collaborator access to the repository but does not verify whether the PAT being used has been granted the necessary repo scope.

The flaw allows users to effectively circumvent the fine-grained access control model that GitHub provides through PAT scopes. Organizations that deliberately issue tokens without repo scope—intending to limit API access to public information or specific non-repository operations—may find that those tokens can still be used to extract private repository data through the search endpoints.

Root Cause

The root cause is a missing authorization check in the search REST API endpoint handlers. The code path responsible for processing search queries against issues and commits validates the user's organizational relationship to repositories but omits the critical step of verifying that the presenting authentication token has the repo scope required for accessing private repository content. This results in a mismatch between the expected access control (scope-based) and the actual enforcement (membership-based only).

Attack Vector

The vulnerability is exploitable over the network by any authenticated user who possesses a valid classic personal access token. The attack does not require any special privileges beyond basic authentication and existing membership in an organization or collaborator status on a repository.

An attacker with a limited-scope PAT (for example, one granted only read:user or notifications scope) can craft search queries against the REST API to enumerate issues and commits from private or internal repositories they have indirect access to. The search API returns data that should be restricted based on the token's scope configuration, effectively leaking sensitive information about private development activities, bug reports, and code changes.

The attacker would leverage standard GitHub REST API search endpoints such as /search/issues and /search/commits with appropriate query parameters to target specific repositories or organizations. Since the user must already have some form of repository access (via organization membership or collaborator status), this represents an authorization boundary violation rather than a complete access control bypass.

Detection Methods for CVE-2026-3582

Indicators of Compromise

• API access logs showing search queries from tokens without repo scope accessing private repository data
• Unusual patterns of search API usage from service accounts or automation tokens with limited scopes
• Audit log entries showing successful search responses for repositories the querying token should not access
• High-volume search API requests from tokens typically used for non-repository operations

Detection Strategies

• Review GitHub Enterprise Server audit logs for search API requests that return private repository content
• Monitor for anomalous API access patterns where limited-scope tokens query repository-specific search endpoints
• Implement alerting on search API activity from tokens that lack the repo scope
• Correlate token scope configurations with actual API endpoint usage to identify scope violations

Monitoring Recommendations

• Enable verbose API logging in GitHub Enterprise Server to capture token scope information with requests
• Establish baseline search API usage patterns to detect anomalous query behavior
• Review authentication logs for classic PAT usage against search endpoints on a regular cadence
• Configure SIEM rules to flag search API responses containing private repository metadata

How to Mitigate CVE-2026-3582

Immediate Actions Required

• Upgrade GitHub Enterprise Server to a patched version immediately: 3.16.15, 3.17.12, 3.18.6, 3.19.3, or 3.20 or later
• Audit existing personal access tokens across your organization to identify tokens with limited scopes that may have been misused
• Review API access logs for evidence of exploitation prior to patching
• Consider revoking and reissuing classic PATs if unauthorized access is suspected

Patch Information

GitHub has released security patches addressing this vulnerability in multiple supported release branches. Organizations should upgrade to the following versions or later:

• Version 3.16.15: GitHub Release Notes 3.16.15
• Version 3.17.12: GitHub Release Notes 3.17.12
• Version 3.18.6: GitHub Release Notes 3.18.6
• Version 3.19.3: GitHub Release Notes 3.19.3

This vulnerability was reported via the GitHub Bug Bounty program.

Workarounds

• Migrate from classic PATs to fine-grained personal access tokens where possible, as these provide more granular repository-level permissions
• Implement network-level restrictions on search API endpoints using reverse proxy rules as a temporary measure
• Enforce organization policies requiring the use of fine-grained tokens over classic PATs
• Limit classic PAT creation through organization security settings until patching is complete

# Check current GitHub Enterprise Server version
ghe-config --get core.package-version

# Verify patch status after upgrade
ghe-config --get core.package-version | grep -E "(3\.16\.1[5-9]|3\.17\.1[2-9]|3\.18\.[6-9]|3\.19\.[3-9]|3\.20)"