CVE-2026-3307

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the owner_id parameter in the request body. Authorization was verified against the repository in the URL, but the action was applied to a different repository specified in the request body. The impact is limited to assigning existing trusted users as bypass reviewers; it does not allow adding arbitrary external users. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-639

• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.25Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.20Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.16Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.13Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.7Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.4Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1Release Notes, Vendor Advisory

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33064Free5GC is an open-source Linux Foundation project for 5th g…7.5
• CVE-2026-33065Free5GC is an open-source Linux Foundation project for 5th g…5.3
• CVE-2026-33066SiYuan is a personal knowledge management system. In version…9
• CVE-2026-33067SiYuan is a personal knowledge management system. Versions 3…9
• CVE-2026-33068Claude Code is an agentic coding tool. Versions prior to 2.1…8.8
• CVE-2026-33069PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2026-33070FileRise is a self-hosted web file manager / WebDAV server. …4.8
• CVE-2026-33071FileRise is a self-hosted web file manager / WebDAV server. …8.8
• CVE-2026-33072FileRise is a self-hosted web file manager / WebDAV server. …7.5
• CVE-2026-33073Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-33074Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-33075FastGPT is an AI Agent building platform. In versions 4.14.8…8.8