CVE-2026-3582 Details
Description
An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program.
A vulnerability allowing incorrect authorization was identified in GitHub Enterprise Server. This issue permitted authenticated users with classic personal access tokens (PATs) that lacked the repo scope to access issues and commits from private and internal repositories through the search REST API endpoints. To exploit this vulnerability, users must have had existing access to the targeted repository via organization membership or collaboration. This vulnerability affects all versions of GitHub Enterprise Server prior to 3.20.
Users can upgrade to GitHub Enterprise Server versions 3.16.15, 3.17.12, 3.18.6, or 3.19.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github enterprise server | < 3.16.15 >= 3.17.0, < 3.17.12 >= 3.18.0, < 3.18.6 >= 3.19.0, < 3.19.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 12, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |