Skip to content
OpenAdvisories
High WID-SEC-2026-1231 6 CVEs

Microsoft GitHub Enterprise: Mehrere Schwachstellen

Published Apr 21, 2026 · Updated Apr 21, 2026 · de-DE

Vendor: Microsoft Product: GitHub Enterprise

Summary

Ein Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um beliebigen Programmcode auszuführen, und um Informationen offenzulegen.

Product

GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.

Vulnerabilities 6

  • High 8.9
    CVE-2026-5921

    Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack

    A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variables from the instance through a timing side-channel attack against the notebook rendering service. Wh…

    GitHub Enterprise Server
  • High 8.1
    CVE-2026-4821 Public exploit Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it was published in error.

  • High 7.5
    CVE-2026-4296

    Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass

    An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a ma…

    GitHub Enterprise Server
  • High 7.2
    CVE-2026-5845

    Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server

    An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations…

    GitHub Enterprise Server
  • Medium 5.3
    CVE-2026-3307

    Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers

    An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating th…

    GitHub Enterprise Server
  • Medium 5.3
    CVE-2026-5512

    Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API

    An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early author…

    GitHub Enterprise Server

Revision history

  1. #1

    Initiale Fassung

References