CVE-2026-5512 (GCVE-0-2026-5512)

Vulnerability from cvelistv5 – Published: 2026-04-21 22:12 – Updated: 2026-04-22 17:39
VLAI?
Title
Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API
Summary
An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
Severity ?
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
CWE
  • CWE-201 - Insertion of sensitive information into sent data
Assigner
References
Impacted products
Vendor Product Version
GitHub Enterprise Server Affected: 3.14.0 , ≤ 3.14.25 (semver)
Affected: 3.15.0 , ≤ 3.15.20 (semver)
Affected: 3.16.0 , ≤ 3.16.16 (semver)
Affected: 3.17.0 , ≤ 3.17.13 (semver)
Affected: 3.18.0 , ≤ 3.18.7 (semver)
Affected: 3.19.0 , ≤ 3.19.4 (semver)
Affected: 3.20.0 , < 3.20.1 (semver)
Create a notification for this product.
Credits
ahacker1
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5512",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T17:38:49.635439Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T17:39:01.520Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "changes": [
                {
                  "at": "3.14.26",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.14.25",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "3.15.21",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.15.20",
              "status": "affected",
              "version": "3.15.0",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "3.16.17",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.16.16",
              "status": "affected",
              "version": "3.16.0",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "3.17.14",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.17.13",
              "status": "affected",
              "version": "3.17.0",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "3.18.8",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.18.7",
              "status": "affected",
              "version": "3.18.0",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "3.19.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.19.4",
              "status": "affected",
              "version": "3.19.0",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "3.20.1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "3.20.1",
              "status": "affected",
              "version": "3.20.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ahacker1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.\u003cbr\u003e"
            }
          ],
          "value": "An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-113",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-113 Interface Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "CWE-201 Insertion of sensitive information into sent data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T22:14:01.033Z",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2026-5512",
    "datePublished": "2026-04-21T22:12:58.344Z",
    "dateReserved": "2026-04-03T18:21:52.907Z",
    "dateUpdated": "2026-04-22T17:39:01.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-5512",
      "date": "2026-04-22",
      "epss": "0.0005",
      "percentile": "0.15492"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-5512\",\"sourceIdentifier\":\"product-cna@github.com\",\"published\":\"2026-04-21T23:16:22.297\",\"lastModified\":\"2026-04-22T21:23:52.620\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"product-cna@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"product-cna@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-201\"}]}],\"references\":[{\"url\":\"https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1\",\"source\":\"product-cna@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-5512\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-22T17:38:49.635439Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-22T17:38:55.515Z\"}}], \"cna\": {\"title\": \"Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"ahacker1\"}], \"impacts\": [{\"capecId\": \"CAPEC-113\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-113 Interface Manipulation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"GitHub\", \"product\": \"Enterprise Server\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"3.14.26\", \"status\": \"unaffected\"}], \"version\": \"3.14.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.14.25\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.15.21\", \"status\": \"unaffected\"}], \"version\": \"3.15.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.15.20\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.16.17\", \"status\": \"unaffected\"}], \"version\": \"3.16.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.16.16\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.17.14\", \"status\": \"unaffected\"}], \"version\": \"3.17.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.17.13\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.18.8\", \"status\": \"unaffected\"}], \"version\": \"3.18.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.18.7\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.19.5\", \"status\": \"unaffected\"}], \"version\": \"3.19.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.19.4\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.20.1\", \"status\": \"unaffected\"}], \"version\": \"3.20.0\", \"lessThan\": \"3.20.1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-201\", \"description\": \"CWE-201 Insertion of sensitive information into sent data\"}]}], \"providerMetadata\": {\"orgId\": \"82327ea3-741d-41e4-88f8-2cf9e791e760\", \"shortName\": \"GitHub_P\", \"dateUpdated\": \"2026-04-21T22:14:01.033Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-5512\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-22T17:39:01.520Z\", \"dateReserved\": \"2026-04-03T18:21:52.907Z\", \"assignerOrgId\": \"82327ea3-741d-41e4-88f8-2cf9e791e760\", \"datePublished\": \"2026-04-21T22:12:58.344Z\", \"assignerShortName\": \"GitHub_P\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.