CVE-2026-103620 Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...