CVE-2026-1999

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge their own pull request into a repository without having push access by exploiting an authorization bypass in the enable_auto_merge mutation for pull requests. This issue only affected repositories that allow forking as the attack relies on opening a pull request from an attacker-controlled fork into the target repository. Exploitation was only possible in specific scenarios. It required a clean pull request status and only applied to branches without branch protection rules enabled. This vulnerability affected GitHub Enterprise Server versions prior to 3.19.2, 3.18.5, and 3.17.11, and was fixed in versions 3.19.2, 3.18.5, and 3.17.11. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-863

• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.11
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.5
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1993The ExactMetrics – Google Analytics Dashboard for WordPress …8.8
• CVE-2026-1994The s2Member plugin for WordPress is vulnerable to privilege…9.8
• CVE-2026-1995In versions before 7.0.0.64, IDrive’s id_service.exe process…7.8
• CVE-2026-1996Certain HP OfficeJet Pro printers may be vulnerable to poten…5.3
• CVE-2026-1997Certain HP OfficeJet Pro printers may expose information if …5.3
• CVE-2026-1998A flaw has been found in micropython up to 1.27.0. This vuln…5.5
• CVE-2026-2000A vulnerability was found in DCN DCME-320 up to 20260121. Im…7.2
• CVE-2026-20001A vulnerability in the REST API of Cisco Secure FMC Software…6.5
• CVE-2026-20002A vulnerability in the web-based management interface of Cis…8.1
• CVE-2026-20003A vulnerability in the REST API of Cisco Secure FMC Software…4.9
• CVE-2026-20004A vulnerability in the TLS library of Cisco IOS XE Software …7.4
• CVE-2026-20005Multiple Cisco products are affected by a vulnerability in t…5.8