What’s Vulnerable › Vulnerabilities

CVE-2022-23741: Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-14 · updated 2026-06-17
• Weakness: CWE-863

Description

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.

Affected products

• GitHub Enterprise Server: before 3.3.17; from 3.4.0 before 3.4.12; from 3.5.0 before 3.5.9; from 3.6.0 before 3.6.5 — fixed in 3.3.17, 3.4.12, 3.5.9, 3.6.5

How to fix

Upgrade to a fixed version: GitHub Enterprise Server 3.3.17, 3.4.12, 3.5.9, 3.6.5. Check the vendor advisory for mitigations.

References

• https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17
• https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12
• https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9
• https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5
• https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17
• https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12
• https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9
• https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5

Get alerted when CVE-2022-23741 or the next vulnerability affects your stack