CVE-2026-9132: github enterprise_server Missing Authorization

Vulnerability summary

CVE-2026-9132 is a medium (CVSS 6.5) Missing Authorization vulnerability in github enterprise_server. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.6% of scored vulnerabilities.

Timeline

1. 30-06-2026
   PublishedVulnerability first disclosed.
2. 01-07-2026
   Last modifiedVulnerability information updated.

Description

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.