An improper authorization fallback in GitHub Enterprise Server’s scoped user‑to‑server (ghu_) tokens allows an authenticated actor to write to or read from private repositories that should be inaccessible, by treating a revoked or deleted installation as a global context. The vulnerability can be chained with token revocation timing and SSH push attribution to obtain and reuse a victim‑scoped token, enabling unauthorized repository modifications. This flaw is an authorization weakness (CWE‑639).

The flaw affected all GitHub Enterprise Server releases prior to 3.21. The following patch releases addressed the issue: 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. Any installation using older minor versions is vulnerable and must be upgraded or patched.

The CVSS score of 7.2 indicates a high severity vulnerability, though the EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Exploitation requires authentication and knowledge of token revocation timing; however, the ability to perform writes to private repositories makes the impact significant for confidentiality, integrity, and availability of codebases. The attack vector is internal or delegated, inferred from the need for an authenticated user and a crafted token use scenario. Given the lack of external exploitation reports, the likelihood of public exploitation is uncertain, but the potential damage warrants prompt remediation.