CVE-2025-3124

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.17

Description A missing authorization issue was identified in GitHub Enterprise Server, allowing users to see the names of private repositories they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overview required filtering using the archived: filter, and all other access controls functioned normally.

Recommendations For versions prior to 3.13.14, update to version 3.13.14 or later. For versions prior to 3.14.11, update to version 3.14.11 or later. For versions prior to 3.15.6, update to version 3.15.6 or later. For versions prior to 3.16.2, update to version 3.16.2 or later. As a temporary workaround, consider restricting access to the Security Overview in GitHub Advanced Security until a patch is available.