CVE-2026-9106
Medium · 5.5CVSS
5.5
EPSS
0.4%
Published
Jun 30, 2026
CISA due date
—
The record
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119730 Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing… CWE-451
- CVE-2026-116632 A malicious web page could insert arbitrary text into the FaceTime call prompt shown by… CWE-451
- CVE-2026-116631 A malicious web page could open a tel link in a window that was showing a different… CWE-451
- CVE-2026-87649 UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a… CWE-451
- CVE-2026-87653 UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36… CWE-451
- CVE-2026-87635 UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-451
- CVE-2026-87624 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36… CWE-451
- CVE-2026-87597 UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36… CWE-451