What’s Vulnerable › Vulnerabilities

CVE-2026-9132: Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-30 · updated 2026-10-25
• Weakness: CWE-862

Description

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program.

Affected products

• GitHub Enterprise Server: before 3.17.17; from 3.18.0 before 3.18.11; from 3.19.0 before 3.19.8; from 3.20.0 before 3.20.4 — fixed in 3.17.17, 3.18.11, 3.19.8, 3.20.4

How to fix

Upgrade to a fixed version: GitHub Enterprise Server 3.17.17, 3.18.11, 3.19.8, 3.20.4. Check the vendor advisory for mitigations.

References

• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17-features
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11-features
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8-features
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4-features

Get alerted when CVE-2026-9132 or the next vulnerability affects your stack