Technical impact
An attacker who already has admin rights on one GitHub Enterprise Server repository can alter the secret‑scanning push protection delegated bypass reviewer list on a different repository by sending a request that changes the owner_id parameter in the request body. This achieves an authorization bypass that lets the attacker assign existing trusted users as bypass reviewers on the target repository. The flaw does not allow the addition of arbitrary external users, so the impact is limited to re‑assigning trusted reviewers rather than providing arbitrary access.
Affected Systems
GitHub Enterprise Server versions released before 3.21 are affected. The vulnerability was patched in releases 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, and 3.20.1. All earlier versions should be upgraded to a party that includes the fix.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. An attacker would need to target a repository where they already possess admin privileges and craft a request that manipulates the owner_id field, so the attack vector is internal privilege escalation within the organization's own GitHub Enterprise Server instance.
