An incorrect authorization check in GitHub Enterprise Server, categorized as CWE‑863, allowed a user‑to‑server token issued to a GitHub App to perform write actions on any public repository that the app could read, even when the app was not explicitly granted access to that repository. The affected operations include creating issues, issue comments, commit comments, and private vulnerability reports. An attacker who obtained a victim’s token could produce these items under effectively enabling impersonation and defacement of public projects.

The vulnerability applies to all releases of GitHub Enterprise Server before version 3.22. The advisory lists specific patched versions: 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. Any instance running a pre‑3.22 release without these patches is susceptible.

The CVSS score of 5.3 places the issue at a moderate severity level. Based on the EPSS score of < 1%, it is inferred that exploitation is unlikely, but the lack of listing in the CISA KEV catalog suggests no widespread, publicly known exploits at this time. It is inferred that the a user‑to‑server token, which may be achieved through phishing, credential compromise, or abuse of a trusted GitHub App a token the attacker can freely write to any public repository that is readable by the app, presenting a moderate but tangible risk to confidentiality and integrity of project metadata.