CVE-2026-57897

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-57897: Exposure of Sensitive Information to an Unauthorized Actor

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...