CVE-2025-3124

Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names

State: Published
Severity: 5.3 Medium
Published: Apr 17, 2025
Updated: Apr 18, 2025
Reserved: Apr 2, 2025

Read the record on cve.org

Description

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overview was required to be filtered only using the `archived:` filter and all other access controls were functioning normally. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.17 and was fixed in versions 3.13.14, 3.14.11, 3.15.6, and 3.16.2.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_P

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
Enterprise ServerGitHub	3.13.0 through 3.13.13Affectedfrom 3.13.14Not affected 3.14.0 through 3.14.10Affectedfrom 3.14.11Not affected 3.15.0 through 3.15.5Affectedfrom 3.15.6Not affected 3.16.0 through 3.16.1Affectedfrom 3.16.2Not affected 3.17.0Not affected

References

https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.14release-notes
https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.11release-notes
https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.6release-notes
https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.2release-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.