CVE-2025-6981

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.18 GitHub Enterprise Server versions 3.14.15 GitHub Enterprise Server versions 3.15.10 GitHub Enterprise Server versions 3.16.6 GitHub Enterprise Server versions 3.17.3

Description An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors API feature was enabled. The Contractors API is a rarely-enabled feature in private preview.

Recommendations Update to GitHub Enterprise Server version 3.14.15. Update to GitHub Enterprise Server version 3.15.10. Update to GitHub Enterprise Server version 3.16.6. Update to GitHub Enterprise Server version 3.17.3. Update to GitHub Enterprise Server version 3.18.