CVE-2026-9106

UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen

State: Published
Severity: 4.8 Medium
Published: Jun 30, 2026
Updated: Jul 1, 2026
Reserved: May 20, 2026

Read the record on cve.org

Description

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	GitHub_P

Weaknesses

CWE-451 User Interface (UI) Misrepresentation of Critical Information

Affected Products

Product	Versions
Enterprise ServerGitHub	3.17.0 through 3.17.16Affectedfrom 3.17.17Not affected 3.18.0 through 3.18.10Affectedfrom 3.18.11Not affected 3.19.0 through 3.19.7Affectedfrom 3.19.8Not affected 3.20.0 through 3.20.3Affectedfrom 3.20.4Not affected 3.21.0 through 3.21.1Affectedfrom 3.21.2Not affected 3.16.0 through 3.16.19Affectedfrom 3.16.20Not affected

References

https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17release-notes
https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11release-notes
https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8release-notes
https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4release-notes
https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.2release-notes
https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.20release-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.