An authorization bypass vulnerability in GitHub Enterprise Server lets any authenticated user read raw diffs or patches of pull requests in private repositories without permission. The flaw arises because tokens for these operations are scoped to the repository name and pull request number rather than a globally unique identifier, creating an opportunity for repository name collision to be exploited.

The vulnerability affects GitHub Enterprise Server versions prior to 3.22. Specifically, versions 3.17, 3.18, 3.19, 3.20, and 3.21 are impacted, with the flaw fixed in releases 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. Upgrading to 3.22 or later removes the issue.

The CVSS score is 6, indicating moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known exploits in the wild. The attack requires legitimate authentication but permits unauthorized disclosure of confidential code changes through a repository name collision strategy, a relatively low‑skill path enabled by the insufficient authorization weakness (CWE‑639).