CVE-2026-3582: 
GitHub Enterprise Server vulnerability analysis and mitigation

CVE-2026-3582 is an Incorrect Authorization vulnerability in GitHub Enterprise Server (GHES) that allows an authenticated user holding a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The vulnerability affects all versions of GHES prior to 3.20, specifically versions up to 3.16.14, 3.17.0–3.17.11, 3.18.0–3.18.5, and 3.19.0–3.19.2. It was disclosed on March 10, 2026, and reported through the GitHub Bug Bounty program. The CVSS v3.1 base score is 4.3 (Medium), and the CVSS v4.0 base score is 5.3 (Medium) (Feedly, GHES 3.16 Release Notes).

The vulnerability is classified as CWE-862 (Missing Authorization). The search REST API endpoints on affected GHES instances failed to properly enforce scope-based access controls on classic PATs, allowing tokens without the repo scope to query private and internal repository content (issues and commits) that should require explicit repository access permissions. Exploitation requires the attacker to already have some level of access to the target repository — either through organization membership or as a collaborator — meaning the authorization check was incomplete rather than entirely absent. No public proof-of-concept code has been identified (Feedly, HackerOne Report).

Successful exploitation allows an authenticated attacker to read issues and commit data from private and internal repositories on a GHES instance using a PAT that should not have such access. The impact is limited to confidentiality — there is no integrity or availability impact. While the attacker must already have some repository access (via org membership or collaborator status), the vulnerability enables privilege escalation within the token's scope, potentially exposing sensitive source code history, internal discussions, and development metadata that the token was not authorized to access (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-3582. The EPSS score is approximately 0.039% (0.000390), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated user with an existing PAT and at least some pre-existing repository access, which limits the attacker pool. The vulnerability was responsibly disclosed via the GitHub Bug Bounty program (Feedly, HackerOne Report).

1. Obtain access: Acquire an authenticated account on the target GHES instance that is a member of an organization or collaborator on a private/internal repository, along with a classic PAT that does not include the repo scope.
2. Identify target repositories: Enumerate organizations or repositories the account has membership or collaborator access to.
3. Craft search API request: Send an authenticated HTTP GET request to the GHES search REST API endpoint (e.g., GET /api/v3/search/issues?q=repo:org/private-repo) using the under-scoped PAT as the Bearer token or via Basic Auth.
4. Retrieve unauthorized data: The API returns issues and/or commits from the private or internal repository despite the PAT lacking the repo scope, bypassing the intended authorization check.
5. Exfiltrate data: Collect returned issue content, commit messages, and associated metadata for reconnaissance or further exploitation (Feedly, HackerOne Report).

• Network: Unusual or high-volume REST API requests to /api/v3/search/issues or /api/v3/search/commits from authenticated users, particularly using PATs without repo scope.
• Logs: GHES audit log entries showing search API calls to private/internal repositories from tokens that do not have the repo scope; review token scope metadata in audit log events for anomalous access patterns.
• Authentication: PATs used for search queries against repositories the token owner has only indirect access to (org membership or collaborator role) — cross-reference token scopes against accessed resources in audit logs.

GitHub has released patched versions addressing CVE-2026-3582: 3.16.15, 3.17.12, 3.18.6, and 3.19.3. Administrators should upgrade to one of these versions or any later release. No configuration-based workaround is available; upgrading is the only remediation. As an interim measure, administrators can audit PAT scopes and revoke or restrict tokens with unnecessary access, and review organization membership and collaborator assignments to minimize the pool of users who could exploit this flaw (GHES 3.16 Release Notes, GHES 3.17 Release Notes, GHES 3.18 Release Notes, GHES 3.19 Release Notes).

The vulnerability was reported through the GitHub Bug Bounty program and disclosed publicly on March 10, 2026. A HackerOne bug bounty report (report #3522254) was made public, and a Red Packet Security post summarized the disclosure under the title "PATs without the required scope can leak issues." No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (HackerOne Report, Red Packet Security).