CVE-2026-75101: 
GitHub Enterprise Server vulnerability analysis and mitigation

CVE-2026-75101 is an authorization bypass vulnerability in GitHub Enterprise Server (GHES) that allows any authenticated user to read the raw diff or patch contents of pull requests in private repositories without proper authorization. The flaw affects all GHES versions prior to 3.22 and was disclosed on September 22, 2026. Fixed versions include 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, GHES 3.17 Release Notes).

The root cause is an insecure direct object reference flaw classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Access tokens for raw pull request diffs and patches were scoped to the repository name and pull request number rather than a globally unique repository identifier. An attacker who creates a repository and pull request on the same GHES instance with names and numbers matching a target private repository can reuse their own legitimately obtained access token to retrieve the private pull request's raw diff or patch content. Exploitation requires the attacker to know the target repository's name and a valid pull request number, and to have an authenticated account on the instance (GitHub Advisory, GHES 3.19 Release Notes).

Successful exploitation allows any authenticated GHES user to read the raw diff or patch of pull requests in private repositories they are not authorized to access, resulting in a high confidentiality impact with no integrity or availability impact. Sensitive source code changes, proprietary logic, credentials accidentally committed, or other confidential information present in pull request diffs could be exposed to unauthorized users. The scope is limited to the affected GHES instance; lateral movement to other systems is not directly enabled by this vulnerability, but exposed code or secrets could facilitate further attacks (GitHub Advisory, GHES 3.20 Release Notes).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The vulnerability was reported through the GitHub Bug Bounty program and is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.0045 (0.45%), indicating a low probability of exploitation in the near term. Exploitation is not automatable at scale due to the requirement to know the target repository name and a valid pull request number, and to hold an authenticated account on the instance (Feedly).

1. Reconnaissance: Identify the target GHES instance and enumerate accessible repository names and pull request numbers. This information may be discoverable through public organization pages, leaked metadata, or social engineering.
2. Account Setup: Obtain or already possess an authenticated account on the target GHES instance (any standard user account suffices).
3. Mirror Repository and PR: Create a new repository on the same GHES instance using the exact same name as the target private repository, then open a pull request with the same pull request number as the target (e.g., PR #42).
4. Obtain Access Token: Generate or retrieve an access token scoped to the attacker-controlled repository's raw diff/patch endpoint.
5. Access Private PR Content: Use the token obtained for the attacker's own repository to request the raw diff or patch of the target private repository's pull request (e.g., GET /repos/<target-org>/<repo-name>/pulls/<pr-number>.diff), exploiting the miscoped token validation to retrieve the private content (GitHub Advisory, GHES 3.21 Release Notes).

• Logs: GHES access logs showing authenticated requests to raw diff or patch endpoints (e.g., /repos/<org>/<repo>/pulls/<number>.diff or .patch) for private repositories by users who are not repository members or collaborators.
• Logs: Unusual patterns of pull request diff/patch access from a single user account across multiple repositories they do not have explicit access to.
• Behavioral: A user account creating repositories and pull requests with names/numbers that closely mirror existing private repositories on the instance, particularly if followed by raw diff API requests.
• Network: API requests to pull request diff/patch endpoints originating from unexpected IP addresses or user agents for private repository resources.

GitHub has released patched versions addressing this vulnerability: 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. Administrators should upgrade their GHES instance to the appropriate patched release as soon as possible. No configuration-based workaround is available; upgrading is the only remediation. Instances running versions prior to 3.17 should upgrade to a supported and patched release (GHES 3.17 Release Notes, GHES 3.18 Release Notes, GHES 3.21 Release Notes).

Coverage of CVE-2026-75101 has been limited to standard vulnerability aggregation and tracking sites. Security news outlet SecurityOnline.info covered the batch of GHES vulnerabilities disclosed in the September 22, 2026 release cycle. No notable independent researcher commentary or significant social media discussion specific to this vulnerability has been identified beyond routine CVE tracking (SecurityOnline).