GitHub · Report #2184950
[PATs] Ability to leak comments from issues without ANY "Issues" repo permissions by utilizing "Pull Request" permissions
Validstatus
mediumseverity
42upvotes
3 Jan 2024disclosed
Summary
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. CVE-2023-51380
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.