CVE-2026-5512 Details
Description
An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
A vulnerability in GitHub Enterprise Server prior to version 3.21 allows authenticated attackers to access the names of private repositories by their numeric IDs. This issue arises from the mobile upload policy API endpoint, which fails to perform proper authorization checks. As a result, validation error messages inadvertently disclose full repository names for inaccessible private repositories. The vulnerability affects all versions of GitHub Enterprise Server prior to 3.21.
Users can upgrade to GitHub Enterprise Server versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, or 3.14.26.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.github.com/en/[email protected]/admin/release-notes#3.14.26 | [email protected] | Release NotesVendor Advisory |
| https://docs.github.com/en/[email protected]/admin/release-notes#3.15.21 | [email protected] | Release NotesVendor Advisory |
| https://docs.github.com/en/[email protected]/admin/release-notes#3.16.17 | [email protected] | Release NotesVendor Advisory |
| https://docs.github.com/en/[email protected]/admin/release-notes#3.17.14 | [email protected] | Release NotesVendor Advisory |
| https://docs.github.com/en/[email protected]/admin/release-notes#3.18.8 | [email protected] | Release NotesVendor Advisory |
| https://docs.github.com/en/[email protected]/admin/release-notes#3.19.5 | [email protected] | Release NotesVendor Advisory |
| https://docs.github.com/en/[email protected]/admin/release-notes#3.20.1 | [email protected] | Release NotesVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-201 | Insertion of Sensitive Information Into Sent Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github enterprise server | < 3.14.26 >= 3.15.0, < 3.15.21 >= 3.16.0, < 3.16.17 >= 3.17.0, < 3.17.14 >= 3.18.0, < 3.18.8 >= 3.19.0, < 3.19.5 3.20.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | New CVE Received | [email protected] |