CVE-2026-9132
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile — higher than 20% of all known CVEs
Summary
A missing authorization vulnerability in GitHub Enterprise Server allowed an authenticated user to read source code from private repositories they did not have access to via the Copilot pull request description diff summary endpoint. The vulnerability affects all versions prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4.
Risk Assessment
The organization risks exposure of confidential source code from private repositories, potentially leading to leakage of intellectual property, trade secrets, or sensitive data. Exploitation requires only an authenticated account with access to at least one repository.
Recommendation
Immediately upgrade GitHub Enterprise Server to one of the patched versions: 3.17.17, 3.18.11, 3.19.8, or 3.20.4. Before upgrading, restrict access to the instance and monitor logs for unusual requests to the Copilot endpoint.
Original NVD description (English source)
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program.