CVE-2026-116296
Write access to archived repositories in GitHub API
- CVSS
- —
- EPSS
- <1%p10
- Published
- ·
- Modified
GitHub API routes for releases, assets, milestones and labels did not reject changes to archived repositories. Users with write access or write-scoped tokens could replace or delete release assets (URLs stayed valid), delete releases and tags, and edit milestones and labels on read-only repos. This affects all GitHub users with write permissions to archived repositories.
What to do: Apply GitHub's update for CVE-2026-116296. No workaround named.
| Product | Affected |
|---|---|
| GitHub | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download URLs, delete releases and tags, and create, edit or delete milestones and labels of a repository that is meant to be read-only. Changing requests on these routes now return 423 Locked for archived repositories.
- Weakness
- CWE-862
In the news
0 storiesNo ingested article mentions this CVE yet.