A flaw in GitHub Enterprise Server lets an attacker who has no credentials create a local user account by using the signup endpoint. The user is granted only the default base permissions that are configured on the instance, allowing account creation without any verification from the external identity provider that is normally required. This missing authentication check is identified as CWE-306.

GitHub Enterprise Server installations running any version prior to 3.21 are affected. The issue was resolved in the 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18 releases, so any instance using those earlier builds, especially with external authentication enabled, remains at risk.

The CVSS score of 6.3 places the vulnerability at medium‑to‑high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Exploitation requires network access to a GitHub Enterprise Server instance that uses an external authentication provider, and the signup endpoint must be reachable. Inferred attack vector is a web‑based signup form that bypasses the external identity provider checks.