MediumVulnerability
CVE-2026-9132: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-9132
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
A missing authorization flaw in GitHub Enterprise Server let an authenticated user read source code from private repositories they could not access. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the diff without checking the target repository's permissions. Exploitation required an account on the instance with read access to at least one repository to use as the comparison base.
Mitigation
Fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. Versions prior to 3.21 are affected.
Related items
- HighGHSA-h4xc-3qfq-jf93: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpointSame vendor · GitHub Advisory Database
- LowGHSA-6gw6-rv2g-25mg: Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsSame vendor · GitHub Advisory Database
- MediumCVE-2026-89278: GPTranslate WordPress plugin exposes plaintext API key to unauthenticated usersSame vendor · NVD/CVE Database
- HighCVE-2026-85887: M365 Copilot incorrect permission assignment allows information disclosureSame vendor · NVD/CVE Database
- CriticalCVE-2026-85885: M365 Copilot command injection allows privilege elevation over a networkSame vendor · NVD/CVE Database