CVE-2026-75101: github enterprise_server

Vulnerability summary

CVE-2026-75101 is a medium (CVSS 6.5) vulnerability in github enterprise_server. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 19.8% of scored vulnerabilities.

Timeline

1. 22-09-2026
   PublishedVulnerability first disclosed.
2. 23-09-2026
   Last modifiedVulnerability information updated.

Description

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to the repository name and pull request number rather than to a globally unique repository identifier, so an attacker who created a repository and pull request matching a target's repository name and pull request number could use a token for their own repository to retrieve the private pull request's contents. Exploitation required the attacker to know the target repository's name and a valid pull request number. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.