A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
References
Configurations
Configuration 1 (hide)
|
History
02 Jul 2026, 15:41
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CPE | cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:* | |
| First Time |
Github enterprise Server
Github |
|
| References | () https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.20 - Release Notes | |
| References | () https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17 - Release Notes | |
| References | () https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11 - Release Notes | |
| References | () https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8 - Release Notes | |
| References | () https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4 - Release Notes | |
| References | () https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.2 - Release Notes |
01 Jul 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | (en) A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program. |
30 Jun 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17. This vulnerability was reported via the GitHub Bug Bounty program. | |
| References |
|
30 Jun 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-30 21:16
Updated : 2026-07-02 15:41
NVD link : CVE-2026-9106
Mitre link : CVE-2026-9106
CVE.ORG link : CVE-2026-9106
JSON object : View
Products Affected
github
- enterprise_server
CWE
CWE-451
User Interface (UI) Misrepresentation of Critical Information