CVE-2026-9106

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-451

• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.20Release Notes
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17Release Notes
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11Release Notes
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8Release Notes
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4Release Notes
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.2Release Notes

Published

Jun 30, 2026

Last Modified

Oct 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91049The EWWW Image Optimizer WordPress plugin before 8.9.1 does …6.4
• CVE-2026-9105An authenticated stack-based buffer overflow vulnerability e…6.5
• CVE-2026-91050The Appointment Booking Plugin – LatePoint | Calendar & Sche…4.3
• CVE-2026-91051The EWWW Image Optimizer WordPress plugin before 8.8.0 does …6.6
• CVE-2026-91057`_gx_multi_line_text_view_display_info_get()` reads one byte…4.6
• CVE-2026-91059The GUIX JPEG software decoder enforces no ordering on JPEG …6.8
• CVE-2026-9107The Kali Forms — Contact Form & Drag-and-Drop Builder plugin…6.4
• CVE-2026-91072The EWWW Image Optimizer WordPress plugin before 8.8.0 does …4.4
• CVE-2026-91073The Subscribe Forms WordPress plugin before 1.6.3 does not …6.8
• CVE-2026-91074The BSK PDF Manager WordPress plugin through 3.8.1 does not …6.8
• CVE-2026-91075The Eupago Gateway For Woocommerce WordPress plugin from 4.5…5.3
• CVE-2026-91076The Robokassa payment gateway for Woocommerce WordPress plug…5.3