CVE-2026-14340: GitHub Enterprise Server Token Authorization Bypass

Technical summary

CVE-2026-14340 is an incorrect authorization vulnerability (CWE-863) in GitHub Enterprise Server affecting all versions prior to 3.22. The vulnerability exists in the authorization logic for user-to-server tokens issued by GitHub Apps. The authorization check failed to verify that the token's installation was explicitly granted access to a target repository; instead, it only checked whether the installation had read permissions. This logic gap allowed a compromised token to execute write operations—specifically creating issues, issue comments, commit comments, and private vulnerability reports—on any public repository regardless of the token's intended scope. The vulnerability has been fixed in patched versions (3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20) by implementing a repository-level scope check for user-to-server tokens from global apps.

Business impact

Compromise of a GitHub App user-to-server token could allow an attacker to impersonate a legitimate user across public repositories without any indication of the app's involvement. This enables unauthorized issue creation, commenting, and reporting of private vulnerability disclosures, potentially damaging repository maintainer reputation, introducing noise or misinformation in issue tracking, or prematurely exposing unpatched vulnerabilities. Organizations relying on GitHub Enterprise Server for secure development workflows and audit trails should be concerned about the authenticity of user actions tied to such tokens.

Affected systems

GitHub Enterprise Server versions prior to 3.22 are affected. Patched versions are available: 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20. Organizations running any earlier version of these release lines, or any version before 3.16, are vulnerable.

Exploitability

Exploitability requires an attacker to first obtain a victim's user-to-server token. Once possessed, exploitation is straightforward—the token can be used via the GitHub API or web interface to create issues, comments, or reports on public repositories. The attack requires network access and an authenticated token but no user interaction or unusual system configuration. The CVSS score of 5.0 (Medium) reflects the requirement for the attacker to have already compromised a token, which limits but does not eliminate practical risk.

Remediation

Immediately upgrade GitHub Enterprise Server to a patched version: 3.21.2 or later, 3.20.4 or later, 3.19.8 or later, 3.18.11 or later, 3.17.17 or later, or 3.16.20 or later. After upgrading, rotate any user-to-server tokens that may have been exposed or used in untrusted environments, and review audit logs for suspicious issue creation, comments, or vulnerability reports attributed to users during the exposure window.

Patch guidance

GitHub has released security updates across all supported release lines. Verify your current GHES version and consult the official GitHub Enterprise Security Advisory for the exact patch version available in your release line. Apply patches in a staging environment first to validate compatibility with any customizations or extensions. Plan patching during a maintenance window to minimize disruption. Note that this vulnerability affects token scoping logic, so patching should be prioritized for any instance where GitHub Apps issue user-to-server tokens.

Detection guidance

Monitor GitHub Enterprise Server audit logs and API activity logs for suspicious patterns: unexpected issue or comment creation by users, especially across multiple repositories not typically accessed by those users; creation of private vulnerability reports by accounts that do not typically engage in security disclosures; or spikes in API calls from GitHub Apps that previously showed low activity. Check for any leaked or exposed tokens in version control history or logs. Review GitHub App installations and their associated permissions, revoking any that are unnecessary or untrusted.

Why prioritize this

Although the CVSS score is Medium (5.0), prioritization should account for the ease of exploitation once a token is compromised and the reputational impact of impersonation. Organizations with strict security policies around token management and robust audit logging can tolerate a slightly longer patch window, but teams with high public-facing repository usage, active GitHub App integrations, or strict compliance requirements should prioritize patching sooner.

Risk score, explained

The CVSS 3.1 score of 5.0 is justified by: Attack Vector (Network) and Attack Complexity (Low) reflecting easy exploitation via API; Privileges Required (Low) because the attacker must hold a valid token; Scope (Changed) because the impact crosses repository boundaries; Confidentiality (None), Integrity (Low, limited to creating data rather than modifying critical data), and Availability (None). The score appropriately reflects a logic flaw that enables unauthorized write operations rather than a system compromise.

Frequently asked questions