CVE-2026-5845

{"id": "CVE-2026-5845", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5845", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T18:03:53.486677Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "product-cna@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "product-cna@github.com", "affectedData": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.20.1", "status": "unaffected"}], "version": "3.20.0", "lessThan": "3.20.1", "versionType": "semver"}, {"status": "affected", "changes": [{"at": "3.19.5", "status": "unaffected"}], "version": "3.19.0", "versionType": "semver", "lessThanOrEqual": "3.19.4"}, {"status": "affected", "changes": [{"at": "3.18.8", "status": "unaffected"}], "version": "3.18.0", "versionType": "semver", "lessThanOrEqual": "3.18.7"}, {"status": "affected", "changes": [{"at": "3.17.14", "status": "unaffected"}], "version": "3.17.0", "versionType": "semver", "lessThanOrEqual": "3.17.13"}, {"status": "affected", "changes": [{"at": "3.16.17", "status": "unaffected"}], "version": "3.16.0", "versionType": "semver", "lessThanOrEqual": "3.16.16"}, {"status": "affected", "changes": [{"at": "3.15.21", "status": "unaffected"}], "version": "3.15.0", "versionType": "semver", "lessThanOrEqual": "3.15.20"}, {"status": "affected", "changes": [{"at": "3.14.26", "status": "unaffected"}], "version": "3.14.0", "versionType": "semver", "lessThanOrEqual": "3.14.25"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-21T23:16:22.473", "references": [{"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "product-cna@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context, which could be chained with token revocation timing and SSH push attribution to obtain and reuse a victim-scoped token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n impropia en la autorizaci\u00f3n de tokens de usuario a servidor (ghu_) con \u00e1mbito en GitHub Enterprise Server permite a un atacante autenticado acceder a repositorios privados fuera del \u00e1mbito de instalaci\u00f3n previsto, lo que puede incluir operaciones de escritura, a trav\u00e9s de un mecanismo de respaldo de autorizaci\u00f3n que trataba una instalaci\u00f3n revocada/eliminada como un contexto de instalaci\u00f3n global, lo que podr\u00eda encadenarse con la temporizaci\u00f3n de la revocaci\u00f3n de tokens y la atribuci\u00f3n de push SSH para obtener y reutilizar un token con \u00e1mbito de v\u00edctima. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y se corrigi\u00f3 en las versiones 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21 y 3.14.26. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72A92258-9FCC-41E0-856B-3C2A495575A6", "versionEndExcluding": "3.14.26"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A14A459-881C-437A-88EC-D721E3005329", "versionEndExcluding": "3.15.21", "versionStartIncluding": "3.15.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B7DCD9A-2CF0-4D96-AA96-ACEC662A8E1F", "versionEndExcluding": "3.16.17", "versionStartIncluding": "3.16.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEC2ADE6-3E31-4889-9A73-B6695FE0AB52", "versionEndExcluding": "3.17.14", "versionStartIncluding": "3.17.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B15B12E-00A8-48E8-81DE-54506B94A2C5", "versionEndExcluding": "3.18.8", "versionStartIncluding": "3.18.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56903EAF-4579-4263-AB0F-863323E7C81A", "versionEndExcluding": "3.19.5", "versionStartIncluding": "3.19.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:3.20.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCA4F97D-688E-45D2-90C0-8A11E9B531AA"}], "operator": "OR"}]}], "sourceIdentifier": "product-cna@github.com"}