CVE-2024-0200 is a high severity (CVSS 7.2) unsafe reflection flaw in GitHub Enterprise Server that could lead to remote code execution. An attacker needs an account with the organization owner role. It was fixed in 3.8.13, 3.9.8, 3.10.5 and 3.11.3, and 3.12 was not affected.
What's affected
The NVD description says all versions of GitHub Enterprise Server before 3.12 were affected. Fixes shipped in:
- 3.8.13
- 3.9.8
- 3.10.5
- 3.11.3
The record references the release notes for each of those versions. We could not load the relevant section of the release notes page when preparing this post, so the versions here come from the NVD record. Check the release notes for your version line before you plan the upgrade.
How to check if you're exposed
On the appliance, check the version over SSH.
ghe-version
The management console and the site admin dashboard also show it. Match it against the fixed versions for your line. If you are on 3.7 or older, those lines are not in the fixed list, so plan a move to a supported release.
What to do now
- Check your GitHub Enterprise Server version and line.
- Upgrade to 3.8.13, 3.9.8, 3.10.5, 3.11.3, or to 3.12 or later.
- Review who holds the organization owner role and remove the role from accounts that do not need it.
- Check audit logs for unusual owner level actions around the time before your upgrade.
- Take a backup before upgrading, as GitHub documents for any appliance upgrade.
Why it matters
The record classes this as CWE-470, use of externally controlled input to select classes or code, often called unsafe reflection. Code looks up a class or method by a name that a user can influence, which can let that user call things the developers never meant to expose.
The precondition is the main brake on risk: an actor must be logged in as an organization owner. That is a privileged role, but owners can be phished, and some instances grant it widely. GitHub says the issue came in through its bug bounty program. The record does not flag it as exploited in the wild. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can an anonymous visitor use this?
No. The description says the actor must be logged in to an account with the organization owner role.
Is GitHub.com affected?
The record concerns GitHub Enterprise Server, the self hosted product.
Sources
Last reviewed: 19 October 2026.
