🎯 New Report #3560256: Cross-repository IDOR in `/settings/security analysis/bypass reviewers` allows unauthorized delegated bypass reviewer modification
🔺Severity: Medium
👽 Reporter: ahacker1
⭐️ Reputation: 7035
🛠 State: resolved
💼 Team: GitHub
💵 Bounty: null
🕐 Submitted: 2026-02-18
⏰ Disclosed: 2026-05-19 00:49:24
📝 Summary: A vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository. Authorization was verified against the repository in the URL, but the action was applied to a different repository specified in the request body. The vulnerability was limited to assigning existing trusted users as bypass reviewers and did not allow adding arbitrary external users. The vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 and 3.20.1. The vulnerability was reported via the GitHub Bug Bounty program.
📂 Report JSON File: 3560256
@hackeronereports