👩‍💻 Anyone can Access Deleted and Private Repository Data on GitHub

You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way. Cross Fork Object Reference (CFOR) vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks).

— Deleted Fork Data: Still accessible.
— Deleted Repo Data: Commits remain.
— Private Repo Data: Can become public.

🔗 Research:
https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github

#github #private #repo #cfor