GitHub Enterprise Server had two authorization mistakes that matter more than the CVEs themselves: an OAuth consent screen could hide organization runner-management rights, and a separate bug could let authenticated users see private repository source they should not have had access to. In practice, a routine approval or a normal authenticated request could cross a trust boundary the UI was supposed to make clear.
GitHub patched three authenticated issues in versions before 3.21 and 3.22, with fixes in 3.17.17, 3.18.11, 3.19.8, 3.20.4, and later releases up to 3.22. The advisory also includes stored XSS in Discussion titles, but the more operationally important problems are the hidden manage_runners:org scope and the private-source exposure through the Copilot pull request description diff summary endpoint.
CVSS 6.5 MEDIUM: a missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. EPSS 0.4% (34th percentile).
CVSS 5.5 MEDIUM: a UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. EPSS 0.4% (29th percentile).
CVSS 5.4 MEDIUM: a stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated… EPSS 0.3% (24th percentile).