Riskcovery

CVE-2026-3306

Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access

State
Published
Severity
5.3 Medium
Published
Mar 10, 2026
Updated
Mar 11, 2026
Reserved
Feb 26, 2026

Read the record on cve.org

Description

An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NGitHub_P

Weaknesses

  • CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

ProductVersions
Enterprise ServerGitHub
  • 3.14.0 through 3.14.23Affectedfrom 3.14.24Not affected
  • 3.15.0 through 3.15.18Affectedfrom 3.15.19Not affected
  • 3.16.0 through 3.16.14Affectedfrom 3.16.15Not affected
  • 3.17.0 through 3.17.11Affectedfrom 3.17.12Not affected
  • 3.18.0 through 3.18.5Affectedfrom 3.18.6Not affected
  • 3.19.0 through 3.19.2Affectedfrom 3.19.3Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.