CVE-2026-9106

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22

Description A UI misrepresentation issue allows an OAuth application to obtain unauthorized access to organization runner management. An attacker can exploit this by creating an OAuth application that requests the manage runners:org scope and tricking a user into authorizing it, because this specific scope is not displayed on the authorization consent screen.

Recommendations Update to version 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, or 3.16.20.