CVE-2023-46646

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected GitHub Enterprise Server version 3.7.0 and above and was fixed in version 3.17.19, 3.8.12, 3.9.7 3.10.4, and 3.11.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
GitHub	Enterprise Server	>= 3.7.0, <= 3.7.18; >= 3.8.0, <= 3.8.11; >= 3.9.0, <= 3.9.6; >= 3.10.0, <= 3.10.3

References

https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4Release Notes
https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19Release Notes
https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7Release Notes
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4Release Notes
https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19Release Notes
https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7Release Notes

Timeline

Published: Dec 21, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-466478.8Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with CVE-2023-466487.5An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invit CVE-2023-466497.0A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organizat CVE-2023-46658.8Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira C CVE-2023-466505.4Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a store CVE-2023-466516.5Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configu CVE-2023-466524.3A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enume CVE-2023-466536.5Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting i CVE-2023-466548.1Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup proc CVE-2023-466556.5Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are publish CVE-2023-466565.3Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the pro CVE-2023-466575.3Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook