🎯 New Report #3527788: Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating
🔺Severity: Medium
👽 Reporter: ahacker1
⭐️ Reputation: 7839
🛠 State: resolved
💼 Team: GitHub
💵 Bounty: null
🕐 Submitted: 2026-01-27
⏰ Disclosed: 2026-08-25 21:22:31
📝 Summary: A vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions.
📂 Report JSON File: 3527788
@hackeronereports