Vaibhav Singh

A UI misrepresentation issue allows an OAuth application to obtain unauthorized access to organization runner management. An attacker can exploit this by creating an OAuth application that requests the `manage runners:org` scope and tricking a user into authorizing it, because this specific scope is not displayed on the authorization consent screen.

An Incorrect Authorization issue was identified in GitHub Enterprise Server, allowing a GitHub App with limited permissions to read issue content inside a private repository. This was only exploitable via user access token, and installation access token was not impacted. The issue was reported via the GitHub Bug Bounty program and has been exploited in real-world attacks.

An incorrect authorization issue was identified in GitHub Enterprise Server, allowing a repository-scoped token with read/write access to modify Action Workflow files without a Workflow scope. The Create or Update file contents API should enforce workflow scope. This issue was reported via the GitHub Bug Bounty program.

An incorrect authorization issue was identified in GitHub Enterprise Server, allowing a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This issue was reported via the GitHub Bug Bounty program.

A UI misrepresentation issue was identified that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this, an attacker would need to create a GitHub App and have a user authorize it through the web authentication flow. The issue occurred when a user updated the set of repositories the app was installed on after the GitHub App had configured additional user-level permissions, leading to more permissions being granted than the user potentially intended.

A UI misrepresentation issue was identified that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user. To exploit this, an attacker would need to create a GitHub App and have a user authorize it. During the initial authorization, all permissions are properly shown, but if the user revisits the authorization flow after the GitHub App configures additional user-level permissions, those extra permissions may not be displayed, leading to more permissions being granted than intended.

An issue has been discovered that allowed a project member with limited permissions to view the project security dashboard.

An improper access control issue was identified in the GitHub Enterprise Server API, allowing an organization member to escalate permissions and gain access to unauthorized repositories within an organization.