Answer in brief
CVE-2026-15783 records a Medium severity (CVSS 5.3) vulnerability in Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites. The current sources do not mark it as known exploited. The current feed maps GitHub/Enterprise Server (generic), GitHub/Enterprise Server (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps GitHub/Enterprise Server (generic), GitHub/Enterprise Server (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| GitHub/Enterprise Servergeneric | 3.17.0 || 3.18.0 || 3.19.0 || 3.20.0 || 3.21.0 | Not reported |
| GitHub/Enterprise Servergeneric | >=3.17.0 <=3.17.17 || >=3.18.0 <=3.18.11 || >=3.19.0 <=3.19.8 || >=3.20.0 <=3.20.4 || >=3.21.0 <=3.21.2 | Not reported |
Published upstream
Jul 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 17, 2026
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read metadata from private repositories they did not have access to, including private repository owners and names, branch names, commit SHAs, commit messages, and the pushing actor. The delegated bypass endpoint resolved a rule suite directly from an attacker-supplied, encoded identifier without verifying that the requesting user could read the rule suite's repository, and because these identifiers are sequential an attacker could enumerate them across the instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3. This vulnerability was reported via the GitHub Bug Bounty program.
Quoted source text, attributed separately from HOL analysis.