CVE-2020-10516

—

CVSS 3.1

9.8 critical

EPSS

2%p74

Published

Jun 3, 2020 (Jun 3, 2020)

Modified

Jun 17, 2026

Description

An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program.

Vendors: github
Products: github
Weakness: CWE-285, CWE-552
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news0 stories

No ingested article mentions this CVE yet.