CVE-2026-14340

{"id": "CVE-2026-14340", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14340", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-02T15:10:33.189761Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "product-cna@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "product-cna@github.com", "affectedData": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.16.20", "status": "unaffected"}], "version": "3.16.0", "versionType": "semver", "lessThanOrEqual": "3.16.19"}, {"status": "affected", "changes": [{"at": "3.17.17", "status": "unaffected"}], "version": "3.17.0", "versionType": "semver", "lessThanOrEqual": "3.17.16"}, {"status": "affected", "changes": [{"at": "3.18.11", "status": "unaffected"}], "version": "3.18.0", "versionType": "semver", "lessThanOrEqual": "3.18.10"}, {"status": "affected", "changes": [{"at": "3.19.8", "status": "unaffected"}], "version": "3.19.0", "versionType": "semver", "lessThanOrEqual": "3.19.7"}, {"status": "affected", "changes": [{"at": "3.20.4", "status": "unaffected"}], "version": "3.20.0", "versionType": "semver", "lessThanOrEqual": "3.20.3"}, {"status": "affected", "changes": [{"at": "3.21.2", "status": "unaffected"}], "version": "3.21.0", "versionType": "semver", "lessThanOrEqual": "3.21.1"}], "platforms": ["Linux"], "defaultStatus": "affected"}]}], "published": "2026-07-01T21:16:43.743", "references": [{"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.20", "tags": ["Product", "Release Notes"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17", "tags": ["Product", "Release Notes"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11", "tags": ["Product", "Release Notes"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8", "tags": ["Product", "Release Notes"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4", "tags": ["Product", "Release Notes"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.2", "tags": ["Product", "Release Notes"], "source": "product-cna@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "product-cna@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. This was possible because the authorization check only verified that the installation had read permissions on the target repository rather than verifying that the token's installation was explicitly granted access to that repository. An attacker who obtained a victim's user-to-server token could create issues, issue comments, commit comments, and private vulnerability reports on any public repository, appearing as the victim user with no indication of the app involvement. This vulnerability was fixed by adding a repository scope check for user-to-server tokens issued by global apps. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n incorrecta fue identificada en GitHub Enterprise Server que permit\u00eda que un token de usuario a servidor con alcance a una instalaci\u00f3n de GitHub App realizara ciertas operaciones de escritura en repositorios p\u00fablicos fuera del alcance previsto del token. Esto fue posible porque la verificaci\u00f3n de autorizaci\u00f3n solo verificaba que la instalaci\u00f3n ten\u00eda permisos de lectura en el repositorio de destino en lugar de verificar que a la instalaci\u00f3n del token se le hab\u00eda concedido acceso expl\u00edcitamente a ese repositorio. Un atacante que obtuviera un token de usuario a servidor de una v\u00edctima podr\u00eda crear incidencias, comentarios de incidencias, comentarios de commits e informes de vulnerabilidad privados en cualquier repositorio p\u00fablico, apareciendo como el usuario v\u00edctima sin ninguna indicaci\u00f3n de la participaci\u00f3n de la aplicaci\u00f3n. Esta vulnerabilidad fue corregida a\u00f1adiendo una verificaci\u00f3n de alcance de repositorio para tokens de usuario a servidor emitidos por aplicaciones globales. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.22 y fue corregida en las versiones 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty."}], "lastModified": "2026-10-25T16:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09FDB053-8EF5-4CAF-9C05-090985C57A77", "versionEndExcluding": "3.16.20"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0612BD3-C04E-4A34-ACEF-4D1F4F723E47", "versionEndExcluding": "3.17.17", "versionStartIncluding": "3.17.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0553891C-ED0B-4D2C-A832-29996F0CE8B2", "versionEndExcluding": "3.18.11", "versionStartIncluding": "3.18.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E67B4A61-E777-4B50-8DFC-DDF6292C4771", "versionEndExcluding": "3.19.8", "versionStartIncluding": "3.19.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A51E85E4-FF55-497C-A39F-F69E224E63BD", "versionEndExcluding": "3.20.4", "versionStartIncluding": "3.20.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "051B2085-DBF2-420B-B356-70C0AB2D97C7", "versionEndExcluding": "3.21.2", "versionStartIncluding": "3.21.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-cna@github.com"}