CVE-2026-75101 Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

CVE-2026-75101 Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

CVE-2026-75101

An authorization bypass vulnerability exists in GitHub Enterprise Server (versions prior to 3.22) due to a repository name collision flaw. Access tokens for raw pull request diffs and patches were incorrectly scoped to the repository name and pull request number rather than a globally unique iden...

CVE-2026-77912 Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-77912

A stored cross-site scripting (XSS) vulnerability exists in GitHub Enterprise Server within the Markdown rendering pipeline . The flaw occurs because the pipeline rewrote quote characters in already-sanitized HTML without performing subsequent re-sanitization, allowing an authenticated attacker t...

CVE-2026-77912 Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

EUVD-2026-84873

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

EUVD-2026-84872

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77987 GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77987 GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77987

A server-side request forgery (SSRF) vulnerability exists in the notebook viewer of GitHub Enterprise Server (versions 3.17 through 3.22). The root cause is the failure to validate the port of user-supplied URLs, despite validating the scheme and host. This allows requests to internal services on...

PT-2026-97051

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.17 through 3.17.20 GitHub Enterprise Server versions 3.18 through 3.18.14 GitHub Enterprise Server versions 3.19 through 3.19.11 GitHub Enterprise Server versions 3.20 through 3.20.7 GitHub Enterprise Server...

PT-2026-97047

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description An authorization bypass allows authenticated users to read the raw diff or patch of pull requests in private repositories. This occurs because access tokens for these resources are...

CVE-2026-77912: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-75101: Authorization Bypass Through User-Controlled Key

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

CVE-2026-77987: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

PT-2026-97052

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.17 through 3.22 Description A server-side request forgery SSRF issue exists in the notebook viewer. While the system validates the scheme and host of a user-supplied URL, it fails to validate the port. This...

EUVD-2026-69714

A server-side request forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster...

EUVD-2026-69715

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

EUVD-2026-69716

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a...