CVE-2026-5845 is a critical flaw (CVSS 9.6) in GitHub Enterprise Server. An authorization fallback lets an authenticated attacker use a scoped user-to-server token to reach private repositories outside the intended installation scope, including writes. Upgrade to 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21 or 3.14.26.
What's affected
- All GitHub Enterprise Server versions before 3.21, per the record.
- Fixed versions: 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21 and 3.14.26.
- The flaw involves scoped user-to-server tokens, which start with ghu_.
How to check if you're exposed
Run ghe-version on the appliance, or read the version in the Management Console. Compare it with the fixed release for your series. Instances on 3.13 or older are not named in the fixed list, so check the release notes for your path forward.
Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.
What to do now
- Upgrade to the fixed patch release for your series.
- Review the audit log for unexpected token use and repository access.
- Revoke and reissue tokens for GitHub Apps you cannot account for.
- Check which private repositories saw unusual writes.
After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.
Why it matters
This is CWE-639 (Authorization Bypass Through User-Controlled Key). The record says the code treated a revoked or deleted installation as a global installation context, which widened a token beyond its scope. It adds that this could be chained with token revocation timing and SSH push attribution to obtain and reuse a token scoped to a victim.
The attacker needs a login, which is why the score is 9.6 and not higher. The CISA KEV flag is false.
GitHub Enterprise Server is a self-hosted appliance, so patching is your job and not GitHub's. The release notes for each series list the fix, and patch releases normally install through the standard upgrade process with a short maintenance window.
Private repositories hold source, secrets that should not have been committed, and deployment scripts. An attacker who can read them, and in this case write to them, can reach much further than the appliance. After upgrading, a review of recent commits to sensitive repositories by unfamiliar identities is a sensible follow up.
Quick check
Is GitHub.com affected?
The record only names GitHub Enterprise Server.
Sources
- GitHub Enterprise Server release notes
- GitHub Enterprise Server release notes
- GitHub Enterprise Server release notes
Last reviewed: 19 October 2026.
