CVE-2026-5512

Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API

MEDIUM

4.3

CVSS Score

Published: April 21, 2026 at 10:12 PM UTC

Updated: October 26, 2026 at 09:10 PM UTC

1 product affected across 1 vendorGitHub Enterprise Server

Using Enterprise Server by GitHub?

Get instant alerts when new vulnerabilities affect Enterprise Server - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.3

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

GitHub Enterprise Server · GitHubgithub-action

95%

v < 3.14.263.15.0 ≤ v < 3.15.213.16.0 ≤ v < 3.16.173.17.0 ≤ v < 3.17.143.18.0 ≤ v < 3.18.83.19.0 ≤ v < 3.19.53.14.0 3.15.0 3.16.0 3.17.0 3.18.0 3.19.0 3.20.0

Affected range stops below 3.20.1, so it looks safe — our inference, not a vendor statement