Description
A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user’s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim’s migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23. This vulnerability was reported via the GitHub Bug Bounty program.
Published: 2026-02-18
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data upload in repository migrations
Action: Immediate Patch
AI Analysis

Impact

A missing authorization check in the repository migration upload endpoint allowed an authenticated attacker to overwrite or replace a victim’s migration archive. By supplying the migration identifier, the attacker could cause victims to download attacker‑controlled data during migration restores or automated imports. The vulnerability can compromise the integrity of repository data and potentially introduce malicious content into a repository. The impact is strictly limited to users who can authenticate to the victim’s GitHub Enterprise Server instance.

Affected Systems

The flaw affects GitHub Enterprise Server installations running any version prior to 3.20. Security updates for this issue were released in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, and 3.14.23.

Risk and Exploitability

The CVSS score of 6.0 indicates a moderate severity vulnerability. EPSS is below 1 %, suggesting a low likelihood of exploitation at present, and the issue is not listed in the CISA KEV catalog. Attackers must be able to authenticate to the GitHub Enterprise Server instance, after which they can upload to a migration export, leading to unauthorized data modification. The missing authorization check (CWE‑862) lies at the core of the issue.

Generated by OpenCVE AI on April 17, 2026 at 18:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the GitHub Enterprise Server to version 3.19.2 or later, with the latest patch containing the fix.
  • If upgrading cannot be performed immediately, restrict or disable the repository migration upload endpoint for all users except administrators until the patch is applied.
  • After applying the patch, audit existing migration archives to detect and remove any unauthorized or attacker‑controlled uploads.

Generated by OpenCVE AI on April 17, 2026 at 18:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 20 Feb 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 19 Feb 2026 22:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

Thu, 19 Feb 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Github
Github enterprise Server
Vendors & Products Github
Github enterprise Server

Wed, 18 Feb 2026 21:00:00 +0000

Type Values Removed Values Added
Description A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user’s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim’s migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23. This vulnerability was reported via the GitHub Bug Bounty program.
Title Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:L'}

Subscriptions

Github Enterprise Server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_P

Published:

Updated: 2026-02-20T19:36:28.885Z

Reserved: 2026-01-22T19:14:46.710Z

Link: CVE-2026-1355

cve-icon Vulnrichment

Updated: 2026-02-20T19:36:22.331Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-18T21:16:23.460

Modified: 2026-02-19T22:08:57.277

Link: CVE-2026-1355

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T18:30:05Z

Weaknesses