CVE-2026-9132

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21

Description An authenticated user can read source code from private repositories they are not authorized to access. The issue occurs because the Copilot pull request description diff summary endpoint accepts a cross-repository comparison range and renders the diff without verifying the requesting user's authorization for the target repository. Exploitation requires an authenticated account on the instance with read access to at least one repository to serve as the comparison base.

Recommendations Update to version 3.17.17 Update to version 3.18.11 Update to version 3.19.8 Update to version 3.20.4