CVE-2026-5512

MediumCVSS 4.3/10Last modified Oct 26, 2026

Description

An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-201

Affected software

VendorProductVersions
GitHubEnterprise Server>= 3.14.0, <= 3.14.25; >= 3.15.0, <= 3.15.20; >= 3.16.0, <= 3.16.16; >= 3.17.0, <= 3.17.13; >= 3.18.0, <= 3.18.7; >= 3.19.0, <= 3.19.4; >= 3.20.0, < 3.20.1

References

Timeline

Published
Apr 21, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-551207.8Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2026-551215.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-551227.1Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-551237.8Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2026-551245.5Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-551257.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-551265.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2026-551277.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-551287.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-551297.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-55137.2The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booCVE-2026-551307.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2026-5512: Medium severity, CVSS 4.3 | Vulnix