GitHub Enterprise Server Incorrect Authorization Vulnerability in Search API

A vulnerability allowing incorrect authorization was identified in GitHub Enterprise Server. This issue permitted authenticated users with classic personal access tokens (PATs) that lacked the repo scope to access issues and commits from private and internal repositories through the search REST API endpoints. To exploit this vulnerability, users must have had existing access to the targeted repository via organization membership or collaboration. This vulnerability affects all versions of GitHub Enterprise Server prior to 3.20.

Impact

Exploitation of this vulnerability could lead to unauthorized access to private and internal repository data, including issues and commit information.

Remediation

Users can upgrade to GitHub Enterprise Server versions 3.16.15, 3.17.12, 3.18.6, or 3.19.3 to address this vulnerability.