CVE-2021-22862

Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks

State: Published
Severity: Not scored
Published: Mar 3, 2021
Updated: Aug 3, 2024
Reserved: Jan 6, 2021

Description

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program.

Scores

The record has no CVSS score.

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
GitHub Enterprise ServerGitHub	3.0 to before 3.0.1Affected

References

https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.