GitHub · Report #2210179
View Repo and Title of Any Private Check Run
Validstatus
mediumseverity
64upvotes
8 Jan 2024disclosed
Summary
Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content besides the name. CVE-2023-46646
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.