CVE-2026-9106 json
UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen
published 2026-06-30 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-40407
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
Patch / fix
- GitHub Enterprise Server 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4, 3.21.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L |
Affected products
- GitHub Enterprise Server
Classification
- Weakness
-
- CWE-451 User Interface (UI) Misrepresentation of Critical Information
References
-
docs.github.com
/en/enterprise-server@3.17/admin/release-notes#3.17.17
release-notes
-
docs.github.com
/en/enterprise-server@3.18/admin/release-notes#3.18.11
release-notes
-
docs.github.com
/en/enterprise-server@3.19/admin/release-notes#3.19.8
release-notes
-
docs.github.com
/en/enterprise-server@3.20/admin/release-notes#3.20.4
release-notes
-
docs.github.com
/en/enterprise-server@3.21/admin/release-notes#3.21.2
release-notes
-
docs.github.com
/en/enterprise-server@3.16/admin/release-notes#3.16.20
release-notes
Sources
- CVE List CVE-2026-9106
- NVD CVE-2026-9106
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.