Skip to content
OpenAdvisories
High NCSC-2026-0219 3 CVEs

Kwetsbaarheden verholpen in GitHub Enterprise Server

Published Jul 3, 2026 · Updated Jul 3, 2026 · nl

Vendor: GitHub Vendor: Microsoft Product: Enterprise Server Product: GitHub Enterprise

Summary

GitHub heeft meerdere kwetsbaarheden verholpen in GitHub Enterprise Server, specifiek in versies vóór 3.21 en 3.22.

Details

Interpretaties
De eerste kwetsbaarheid betreft een stored cross-site scripting (XSS) waarbij geauthenticeerde aanvallers kwaadaardige JavaScript-payloads kunnen injecteren in Discussion-titels. Deze scripts worden uitgevoerd in de context van andere gebruikers die de betreffende discussies bekijken. De tweede kwetsbaarheid is een UI-misrepresentatie waarbij het OAuth-scope manage_runners:org verborgen werd op het toestemmingsscherm, waardoor OAuth-applicaties onbedoeld toegang konden krijgen tot organisatie runner management functies. De derde kwetsbaarheid betreft een ontbrekende autorisatie, waardoor geauthenticeerde gebruikers toegang konden krijgen tot broncode van private repositories waar zij geen rechten voor hadden, via het Copilot pull request description diff summary endpoint.

Oplossingen
GitHub heeft updates uitgebracht in versies 3.17.17, 3.18.11, 3.19.8, 3.20.4, en latere releases tot en met 3.22 om deze kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 3

  • Medium 6.3
    CVE-2026-10585

    Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category

    A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbitrary JavaScript in another user's browser by injecting a crafted payload into the title of a Discussion in the Q&A ca…

    GitHub Enterprise Server
  • Medium 6.0
    CVE-2026-9132

    Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint

    A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted …

    GitHub Enterprise Server
  • Medium 4.8
    CVE-2026-9106

    UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen

    A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the …

    GitHub Enterprise Server

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.20
  • Reference
    https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17
  • Reference
    https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11
  • Reference
    https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8
  • Reference
    https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4
  • Reference
    https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.2