Riskcovery

CVE-2026-1355

Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports

State
Published
Severity
6.0 Medium
Published
Feb 18, 2026
Updated
Feb 20, 2026
Reserved
Jan 22, 2026

Read the record on cve.org

Description

A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user’s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim’s migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23. This vulnerability was reported via the GitHub Bug Bounty program.

Scores

CVSSScoreVectorSource
4.06.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:LGitHub_P

Weaknesses

Affected Products

ProductVersions
Enterprise ServerGitHub
  • 3.19.0 through 3.19.1Affectedfrom 3.19.2Not affected
  • 3.18.0 through 3.18.4Affectedfrom 3.18.5Not affected
  • 3.17.0 through 3.17.10Affectedfrom 3.17.11Not affected
  • 3.16.0 through 3.16.13Affectedfrom 3.16.14Not affected
  • 3.15.0 through 3.15.17Affectedfrom 3.15.18Not affected
  • 3.14.0 through 3.14.22Affectedfrom 3.14.23Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.