Vulnerability Description
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Github | Enterprise Server | < 3.16.20 |
Related Weaknesses (CWE)
References
- https://docs.github.com/en/[email protected]/admin/release-notes#3.16.20Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.17.17Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.18.11Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.19.8Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.20.4Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.21.2Release Notes
FAQ
What is CVE-2026-9106?
CVE-2026-9106 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could ex...
How severe is CVE-2026-9106?
CVE-2026-9106 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-9106?
Check the references section above for vendor advisories and patch information. Affected products include: Github Enterprise Server.