Back to overview

CVE-2026-9106

MEDIUM
4.8
CVSS 4.0
Description
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17. This vulnerability was reported via the GitHub Bug Bounty program.

Metadata

CVE ID
CVE-2026-9106
State
PUBLISHED
Assigner
GitHub_P
Reserved
2026-05-20 17:12 UTC
Published
2026-06-30 20:21 UTC
Last updated
2026-06-30 21:04 UTC
Primary CWE
CWE-451
CWE-451: User Interface (UI) Misrepresentation of Critical I…
Vendor / Product
GitHub / Enterprise Server
Sources
cve.org  ·  NVD

Severity & Metrics

4.8 MEDIUM CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products (1)
VendorProductPlatformVersions
GitHub Enterprise Server — 3.17.0 ≤ 3.17.16, 3.18.0 ≤ 3.18.10, 3.19.0 ≤ 3.19.7, 3.20.0 ≤ 3.20.3 …
Weakness (CWE)
CWESourceDescription
CWE-451 cna CWE-451: User Interface (UI) Misrepresentation of Critical Information
CVSS scores (1)
ScoreSeverityVersionSourceVector
4.8 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
References (5)
Back to overview