CVE-2025-6981

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors API feature was enabled. The Contractors API is a rarely-enabled feature in private preview. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18 and was fixed in versions 3.14.15, 3.15.10, 3.16.6 and 3.17.3

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
GitHub	Enterprise Server	>= 3.14.0, < 3.14.15; >= 3.15.0, < 3.15.10; >= 3.16.0, < 3.16.6; >= 3.17.0, < 3.17.3

References

https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.15Release Notes
https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.10Release Notes
https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.6Release Notes
https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.3Release Notes

Timeline

Published: Jul 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-69826.9Use of Hard-coded Credentials in TP-Link Archer C50 V3( <= 180703)/V4( <= 250117 )/V5( <= 200407 ), and C20 V5 (<US_V5_260419 or CVE-2025-698206.0Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath fun CVE-2025-698217.4An issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service via the BLE connecti CVE-2025-698227.4An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate priv CVE-2025-6982810.0File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary CVE-2025-69835.1A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into performing unintended acti CVE-2025-69847.5The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to ins CVE-2025-698485.4NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnera CVE-2025-69857.5The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSL CVE-2025-69866.5The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter CVE-2025-69876.4The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all ve CVE-2025-698718.1A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The fu