CVE-2026-15783: 
GitHub Enterprise Server vulnerability analysis and mitigation

CVE-2026-15783 is a missing authorization vulnerability in GitHub Enterprise Server (GHES) that allows an authenticated user with write access to any repository to read metadata from private repositories they do not have access to. Exposed metadata includes private repository owners and names, branch names, commit SHAs, commit messages, and the pushing actor. The vulnerability affects all GHES versions prior to 3.22, specifically versions 3.17.0–3.17.17, 3.18.0–3.18.11, 3.19.0–3.19.8, 3.20.0–3.20.4, and 3.21.0–3.21.2. It was disclosed on July 17, 2026, and carries a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, GHES 3.17 Release Notes).

The root cause is CWE-862 (Missing Authorization): the delegated bypass endpoint resolved a rule suite object directly from an attacker-supplied, encoded identifier without verifying that the requesting user had read access to the rule suite's associated repository (GitHub Advisory). Because rule suite identifiers are sequential integers, an authenticated attacker could systematically enumerate them across the entire GHES instance to harvest metadata from any private repository. Exploitation requires only network access to the GHES instance and a valid account with write access to at least one repository — no elevated privileges or special configuration are needed (GHES 3.21 Release Notes). The vulnerability was reported through the GitHub Bug Bounty program.

Successful exploitation allows any authenticated GHES user with repository write access to enumerate and read metadata from private repositories across the entire instance, including repository owner names, repository names, branch names, commit SHAs, commit messages, and information about who pushed commits (GitHub Advisory). The impact is limited to confidentiality — there is no integrity or availability impact. While this does not grant code access or write capabilities to the targeted repositories, the exposed metadata could facilitate targeted social engineering, reconnaissance for further attacks, or disclosure of sensitive project information in enterprise environments.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.0027 (0.27%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The sequential nature of the identifiers makes the attack straightforward to automate for any authenticated user, but the requirement for an existing account limits the attacker pool to insiders or compromised accounts.

1. Obtain authenticated access: Acquire a valid GHES account with write access to at least one repository on the target instance (e.g., through a legitimate account, a compromised credential, or a newly created account if self-registration is enabled).
2. Identify the delegated bypass endpoint: Locate the GHES API endpoint that handles delegated bypass rule suite resolution. This endpoint accepts an attacker-supplied, encoded rule suite identifier.
3. Enumerate sequential identifiers: Craft API requests to the delegated bypass endpoint, iterating through sequential integer identifiers (e.g., starting from 1 and incrementing). Because identifiers are sequential and the endpoint does not verify read access to the associated repository, each valid identifier returns metadata for the corresponding rule suite's repository.
4. Harvest private repository metadata: Collect the returned metadata for each valid identifier, including private repository owner names, repository names, branch names, commit SHAs, commit messages, and pushing actor information.
5. Use metadata for further reconnaissance: Leverage the harvested information to identify high-value repositories, understand project structure, or plan further targeted attacks (GitHub Advisory, GHES 3.20 Release Notes).

• Network: Unusual volume of API requests to the GHES delegated bypass endpoint from a single authenticated user, particularly with sequentially incrementing identifier parameters; requests targeting repositories the user does not have explicit read access to.
• Logs: GHES audit logs showing repeated access to the rule suite resolution endpoint by a single user account across many different repository identifiers in a short time window; API access log entries with sequential numeric identifiers in request parameters.
• Behavioral: A user account with write access to only one or a few repositories generating a disproportionately high number of API calls related to rule suites or delegated bypass functionality; access patterns inconsistent with normal developer activity (e.g., bulk enumeration outside business hours).

GitHub has released patched versions addressing this vulnerability: 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3, all released on July 16, 2026; all versions 3.22 and later are also unaffected (GHES 3.17 Release Notes, GHES 3.21 Release Notes). Upgrading to a patched version is the recommended and primary remediation. If immediate patching is not possible, administrators should review and restrict write access permissions to limit the number of users who could exploit this endpoint, and monitor API logs for suspicious enumeration activity targeting the delegated bypass endpoint (GitHub Advisory).