CVE-2026-5512

The record

An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

Affected packages

Related vulnerabilities

• CVE-2026-105777 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before… CWE-201
• CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is… CWE-201
• CVE-2026-62088 Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress… CWE-201
• CVE-2026-81804 Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore Migration <= 2.4.2… CWE-201
• CVE-2026-78303 Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in… CWE-201
• CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page… CWE-201
• CVE-2026-86505 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project… CWE-201
• CVE-2026-86497 In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without… CWE-201