@e2e-dev/github before version 0.4.1 contains an improper authorization flaw that permits pull request commenters to hijack CI test reports. Because the findComment and upsertComment functions in post.ts never check the comment author, an attacker can post a comment with a predictable marker that captures the CI output. This allows the attacker to receive results in their own comment, change failure statuses to passes, or suppress legitimate reports, undermining the authenticity and trust of CI information. The weakness corresponds to CWE‑863.

The affected product is tester‑army’s @e2e-dev/github package for all versions older than 0.4.1. No other vendors or product versions are listed, so systems using any pre‑0.4.1 release are at risk.

The vulnerability has a CVSS score of 5.1, indicating a moderate impact. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires the ability to post comments on a pull request, which is typically granted to contributors or anyone with write access to the repository. Once the attacker posts the predictable marker comment, the flaw can be used to expose and manipulate CI results without any bypass of authentication or elevated privileges. Overall, the risk is moderate but should be mitigated promptly to preserve CI integrity.