CVE-2021-22862 - CVE House
Back to Database
Status published Medium CVE-2021-22862

Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks

Vulnerability Description

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-22862

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Teddy Katz

References

More from GitHub

View All →
CVE-2025-8447
Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access
High 7
CVE-2025-6981
Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access
Medium 5.3
CVE-2025-6600
GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API
Medium 6.3
CVE-2025-3509
Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation
High 7.1
CVE-2025-3246
Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers
High 8.6

Affected Vendor

Affected Software

GitHub Enterprise Server
Vulnerable Versions:
3.0

Timeline

Official Publish: March 3rd, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-285

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion