CVE-2024-8263 - CVE House
Back to Database
Status published Medium CVE-2024-8263

An improper privilege management vulnerability allowed arbitrary workflows to be...

Vulnerability Description

An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8263

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • syvb

References

More from GitHub

View All →
CVE-2025-8447
Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access
High 7
CVE-2025-6981
Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access
Medium 5.3
CVE-2025-6600
GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API
Medium 6.3
CVE-2025-3509
Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation
High 7.1
CVE-2025-3246
Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers
High 8.6

Affected Vendor

Affected Software

GitHub Enterprise Server
Vulnerable Versions:
3.14, 3.13.0, 3.12.0, 3.11.0, 3.10.0

Timeline

Official Publish: September 23rd, 2024
Last Modified: September 23rd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-269

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1222 File and Directory Permissions Modification
Defense Evasion
T1134 Access Token Manipulation
Defense Evasion