A vulnerability in GitHub Enterprise Server allows authenticated users to bypass authorization and access sensitive private repository data, necessitating an immediate update.

This is an authorization bypass vulnerability (CWE-639) where access tokens for raw pull request diffs are improperly scoped to the repository name and pull request number instead of a globally unique identifier. Any authenticated user can potentially retrieve private contents by creating a repository and pull request that matches the target's naming and numbering.

The exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive intellectual property contained within private repositories. Given the CVSS score of 6.0, the risk is categorized as Medium; however, the potential for intellectual property theft in enterprise environments elevates the criticality of this flaw. Unauthorized access to code diffs can expose proprietary logic, security secrets, or upcoming product features.

Immediate Action: Upgrade GitHub Enterprise Server instances to versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, or 3.21.6 immediately to apply the required authorization logic fixes.

Proactive Monitoring: Review repository access logs for anomalous pull request access patterns, particularly those originating from user-created repositories that mirror internal naming conventions.

Compensating Controls: Ensure strict adherence to internal repository access controls and consider limiting the ability of standard users to create new repositories if such policies are feasible within the organization.

Public Exploit Available: Unknown.

Organizations utilizing GitHub Enterprise Server must prioritize the application of the vendor-supplied patches to remediate this authorization bypass. Because the vulnerability allows for the unauthorized reading of private repository content, failing to update leaves sensitive development data exposed to any authenticated user on the instance. Please verify the current version of your installation and apply the corresponding fix from the release notes provided by GitHub.