« Volver al listado

CVE-2026-5845

Estado: AnalizadaAlta (7.2)—

An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context, which could be chained with token revocation timing and SSH push attribution to obtain and reuse a victim-scoped token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de escalada de privilegios por fallo de autorización que permite a usuario autenticado acceder a repositorios privados fuera del alcance con operaciones de escritura; AV:L, PR:L sin UI confirman T1068. Impactos: acceso a credenciales/tokens (T1078.001), lectura de datos privados (T155

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementPassword PoliciesRemote Data Storage

Tecnologías afectadas (1)

Github — Enterprise Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-5845",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-5845",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-22T18:03:53.486677Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.6,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 3.1
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "product-cna@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "product-cna@github.com",
      "affectedData": [
        {
          "vendor": "GitHub",
          "product": "Enterprise Server",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.20.1",
                  "status": "unaffected"
                }
              ],
              "version": "3.20.0",
              "lessThan": "3.20.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.19.5",
                  "status": "unaffected"
                }
              ],
              "version": "3.19.0",
              "versionType": "semver",
              "lessThanOrEqual": "3.19.4"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.18.8",
                  "status": "unaffected"
                }
              ],
              "version": "3.18.0",
              "versionType": "semver",
              "lessThanOrEqual": "3.18.7"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.17.14",
                  "status": "unaffected"
                }
              ],
              "version": "3.17.0",
              "versionType": "semver",
              "lessThanOrEqual": "3.17.13"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.16.17",
                  "status": "unaffected"
                }
              ],
              "version": "3.16.0",
              "versionType": "semver",
              "lessThanOrEqual": "3.16.16"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.15.21",
                  "status": "unaffected"
                }
              ],
              "version": "3.15.0",
              "versionType": "semver",
              "lessThanOrEqual": "3.15.20"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.14.26",
                  "status": "unaffected"
                }
              ],
              "version": "3.14.0",
              "versionType": "semver",
              "lessThanOrEqual": "3.14.25"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-04-21T23:16:22.473",
  "references": [
    {
      "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product-cna@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context, which could be chained with token revocation timing and SSH push attribution to obtain and reuse a victim-scoped token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program."
    }
  ],
  "lastModified": "2026-06-17T10:59:44.860",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72A92258-9FCC-41E0-856B-3C2A495575A6",
              "versionEndExcluding": "3.14.26"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A14A459-881C-437A-88EC-D721E3005329",
              "versionEndExcluding": "3.15.21",
              "versionStartIncluding": "3.15.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B7DCD9A-2CF0-4D96-AA96-ACEC662A8E1F",
              "versionEndExcluding": "3.16.17",
              "versionStartIncluding": "3.16.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEC2ADE6-3E31-4889-9A73-B6695FE0AB52",
              "versionEndExcluding": "3.17.14",
              "versionStartIncluding": "3.17.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B15B12E-00A8-48E8-81DE-54506B94A2C5",
              "versionEndExcluding": "3.18.8",
              "versionStartIncluding": "3.18.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56903EAF-4579-4263-AB0F-863323E7C81A",
              "versionEndExcluding": "3.19.5",
              "versionStartIncluding": "3.19.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:3.20.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCA4F97D-688E-45D2-90C0-8A11E9B531AA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-cna@github.com"
}