🎯 New Report #3638909: GitHub scoped user to server tokens can escape their installation
🔺Severity: High
👽 Reporter: ahacker1
⭐️ Reputation: 7591
🛠 State: resolved
💼 Team: GitHub
💵 Bounty: null
🕐 Submitted: 2026-03-31
⏰ Disclosed: 2026-07-29 23:35:21
📝 Summary: An improper authorization vulnerability in scoped user-to-server (ghu ) token authorization in GitHub Enterprise Server was discovered. The vulnerability allowed an authenticated attacker to access private repositories outside the intended installation scope, which could have included write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26.
📂 Report JSON File: 3638909
@hackeronereports