All vulnerabilities
CVE-2026-103620

Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

GitHub Enterprise Server
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.50%Chance of exploitation activity in the next 30 days, higher than 41% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.18.*Also 3.19.*, 3.20.* and 2 moreCVE List
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required pull-request review but did not restrict branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content. This vulnerability affected supported GitHub Enterprise Server releases in the 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.18.16, 3.19.13, 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported via the GitHub Bug Bounty program.

Text from CVE List

Affected versions 5

  • Enterprise Serveraffected: 3.18.0 before 3.18.*CVE List
  • Enterprise Serveraffected: 3.19.0 before 3.19.*CVE List
  • Enterprise Serveraffected: 3.20.0 before 3.20.*CVE List
  • Enterprise Serveraffected: 3.21.0 before 3.21.*CVE List
  • Enterprise Serveraffected: 3.22.0 before 3.22.*CVE List

References 5