CVE-2026-9106

UNKNOWN 0.0

UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17. This vulnerability was reported via the GitHub Bug Bounty program.

CWE	CWE-451
Vendor	github
Product	enterprise server
Ecosystems	DevTools
Industries	Technology
Published	Jun 30, 2026
Last Updated	Jun 30, 2026

Stay Ahead of the Next One

Get instant alerts for github enterprise server

Be the first to know when new unknown vulnerabilities affecting github enterprise server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

GitHub / Enterprise Server

3.17.0 ≤ 3.17.16 3.18.0 ≤ 3.18.10 3.19.0 ≤ 3.19.7 3.20.0 ≤ 3.20.3 3.21.0 ≤ 3.21.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.17.17 docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.18.11 docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.19.8 docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.20.4 docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.21.2

Credits

VAIBHAV SINGH (@vaib25vicky)