GitHub Enterprise Server Incorrect Authorization Vulnerability in Contractors API

A vulnerability allowing unauthorized read access to internal repository contents for contractor accounts has been identified in GitHub Enterprise Server. This issue arises when the Contractors API feature, which is in private preview, is enabled. The vulnerability affects all versions of GitHub Enterprise Server prior to 3.18. The root cause is a lack of proper authorization checks, which has been addressed in the patched versions. Exploitation of this vulnerability could lead to unauthorized access to sensitive repository information.

Impact

Exploitation of this vulnerability could result in unauthorized access to internal repository contents, potentially exposing sensitive information.

Remediation

To address this vulnerability, GitHub Enterprise Server instances should be updated to version 3.14.15, 3.15.10, 3.16.6, or 3.17.3.