CVE-2026-5512: GitHub Enterprise Server Info Leak Flaw

CVE-2026-5512 Overview

An improper authorization vulnerability was identified in GitHub Enterprise Server that allows an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This information disclosure vulnerability enables attackers with valid authentication to enumerate private repository names across the organization, potentially exposing sensitive project information and organizational structure.

Critical Impact

Authenticated users can discover private repository names through numeric ID enumeration, potentially revealing confidential project codenames, internal tooling, and organizational structure to unauthorized parties.

Affected Products

• GitHub Enterprise Server versions prior to 3.21
• GitHub Enterprise Server versions 3.14.x prior to 3.14.26
• GitHub Enterprise Server versions 3.15.x prior to 3.15.21
• GitHub Enterprise Server versions 3.16.x prior to 3.16.17
• GitHub Enterprise Server versions 3.17.x prior to 3.17.14
• GitHub Enterprise Server versions 3.18.x prior to 3.18.8
• GitHub Enterprise Server versions 3.19.x prior to 3.19.5
• GitHub Enterprise Server versions 3.20.x prior to 3.20.1

Discovery Timeline

• 2026-04-21 - CVE-2026-5512 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-5512

Vulnerability Analysis

This vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) exists within the mobile upload policy API endpoint of GitHub Enterprise Server. The fundamental issue stems from improper authorization sequencing where the application validates input parameters before verifying the user's access rights to the requested resource. When validation fails, the error message includes the full repository name, inadvertently disclosing private repository information to unauthorized authenticated users.

The attack requires only low privileges (authenticated user status) and can be executed remotely over the network without any user interaction. While the confidentiality impact is limited to repository name disclosure rather than repository contents, this information leakage can facilitate further targeted attacks by revealing organizational structure and confidential project names.

Root Cause

The root cause is an improper authorization check sequence in the mobile upload policy API endpoint. The endpoint performs input validation before conducting authorization checks, creating a window where error messages generated during validation inadvertently include sensitive repository name information. This violates the security principle of "fail securely" where authorization should be verified before any processing that could leak information about the resource.

The authorization logic should have been implemented as an early check before any validation that references the target repository by name. Instead, the validation routine retrieved repository metadata (including the name) to validate the request, then included this metadata in error responses even when the caller lacked access permissions.

Attack Vector

The attack leverages the network-accessible mobile upload policy API endpoint. An authenticated attacker can systematically enumerate repository IDs by making requests to the vulnerable endpoint with incremental numeric identifiers. For each request targeting a repository the attacker lacks access to, the validation error response discloses the full repository name.

This enumeration attack can be automated to discover all private repository names across the GitHub Enterprise Server instance, requiring only standard authenticated API access. The attacker does not gain access to repository contents, but the disclosed names may reveal sensitive information about projects, clients, or internal initiatives.

Detection Methods for CVE-2026-5512

Indicators of Compromise

• Unusual volume of requests to the mobile upload policy API endpoint from a single authenticated user
• Sequential or patterned numeric repository ID values in API request parameters
• High rate of validation error responses (4xx status codes) from the mobile upload policy endpoint
• API access patterns showing rapid requests across many repository IDs the user does not have access to

Detection Strategies

• Monitor API access logs for abnormal request patterns to the mobile upload policy endpoint
• Implement rate limiting alerts for endpoints returning validation errors with repository metadata
• Deploy anomaly detection to identify authenticated users accessing large numbers of repositories they lack permissions for
• Review authentication logs for accounts exhibiting enumeration behavior patterns

Monitoring Recommendations

• Enable verbose logging for the mobile upload policy API endpoint to capture request parameters
• Configure alerting for unusual API error rate increases from individual user sessions
• Implement baseline monitoring for normal mobile upload policy endpoint usage patterns
• Integrate GitHub Enterprise Server audit logs with SIEM solutions for centralized monitoring

How to Mitigate CVE-2026-5512

Immediate Actions Required

• Identify your current GitHub Enterprise Server version and verify if it is affected
• Plan emergency maintenance window to apply security patches
• Review API access logs for any signs of exploitation prior to patching
• Consider temporarily restricting access to the mobile upload policy endpoint if exploitation evidence is found

Patch Information

GitHub has released security patches across multiple supported version branches. Organizations should upgrade to the appropriate fixed version based on their current deployment:

• Version 3.20.x: Upgrade to 3.20.1 - GitHub Release Notes 3.20.1
• Version 3.19.x: Upgrade to 3.19.5 - GitHub Release Notes 3.19.5
• Version 3.18.x: Upgrade to 3.18.8 - GitHub Release Notes 3.18.8
• Version 3.17.x: Upgrade to 3.17.14 - GitHub Release Notes 3.17.14
• Version 3.16.x: Upgrade to 3.16.17 - GitHub Release Notes 3.16.17
• Version 3.15.x: Upgrade to 3.15.21 - GitHub Release Notes 3.15.21
• Version 3.14.x: Upgrade to 3.14.26 - GitHub Release Notes 3.14.26

This vulnerability was reported via the GitHub Bug Bounty program, indicating responsible disclosure practices were followed prior to patch availability.

Workarounds

• Implement network-level access controls to restrict API endpoint access to trusted IP ranges
• Deploy a web application firewall (WAF) with rules to rate-limit and monitor mobile upload policy API requests
• Enable enhanced audit logging to detect enumeration attempts while awaiting patch deployment
• Review and restrict authenticated user accounts to minimize potential attack surface

# Example: Check current GitHub Enterprise Server version
ghe-version

# Example: Apply security update (backup first)
ghe-upgrade -y /path/to/github-enterprise-3.20.1.pkg