CVE-2026-6736
mediumpriority · track · 26OT risk · elevatedEPSS 0.003 · 18 %ileDEEUUSEPSS · scored 2026-10-27
An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation and session establishment without identity provider validation. The created account was limited to the default base permissions configured on the instance. Exploitation required network access to a GHES instance configured with an external authentication provider. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.7–6.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (20)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1432Microsoft GitHub Enterprise: Mehrere SchwachstellenDeutsch2026-05-07csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2026-6736cnnvd
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18enisa_euvd
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15enisa_euvd
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9enisa_euvd
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6enisa_euvd
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2enisa_euvd
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18Release NotesVendor Advisorynvd
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15Release NotesVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan