Read the docs
TI-2021-05723 Aliases CVE-2021-22862GHSA-2xwj-g27r-p9cr

Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks

Priority LOW 30CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program.

Why it matters now

EPSS 0.00839 58th percentileScored 2026-11-07
Fix Fixed GitHub Enterprise Server (GitHub): 3.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitHubGitHub Enterprise Server3.0 to before 3.0.13.0.1Patch availableCNA
  • GitHub Enterprise Server VendorGitHub Affected 3.0 to before 3.0.1 Fixed in 3.0.1 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:github:github:3.0.0:-:*:*:*:*:*:*3.0.0VulnerableGitHub
cpe:2.3:a:github:github:3.0.0:rc1:*:*:*:*:*:*3.0.0 rc1VulnerableGitHub
cpe:2.3:a:github:github:3.0.0:rc2:*:*:*:*:*:*3.0.0 rc2VulnerableGitHub
  • cpe:2.3:a:github:github:3.0.0:-:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·GitHub
  • cpe:2.3:a:github:github:3.0.0:rc1:*:*:*:*:*:* Versions 3.0.0 rc1 Vulnerable ·GitHub
  • cpe:2.3:a:github:github:3.0.0:rc2:*:*:*:*:*:* Versions 3.0.0 rc2 Vulnerable ·GitHub

Remediation

  • Fix · CNA GitHub Enterprise Server (GitHub) Fixed in 3.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22862
  2. 2026-10-03 Alias added: GHSA-2xwj-g27r-p9cr

References

Other 1

  • TI-2017-13538 The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization… CVSS 3.0CRITICAL 9.8
  • TI-2020-08450 Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member CVSS 3.1CRITICAL 9.8
  • TI-2020-08453 Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server CVSS 3.1HIGH 8.8
  • TI-2020-08452 Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server CVSS 3.1HIGH 8.8
  • TI-2021-05724 Improper authorization in GitHub Enterprise Server CVSS 3.1HIGH 8.1
  • TI-2012-01828 GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide… CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences