CVE-2025-6981

An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors API feature was enabled. The Contractors API is a rarely-enabled feature in private preview. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18 and was fixed in versions 3.14.15, 3.15.10, 3.16.6 and 3.17.3

CVSS

No CVSS.

References

Link	Resource
https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.15
https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.10
https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.6
https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.3

Configurations

No configuration.

History

16 Jul 2025, 14:58

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-15 21:15

Updated : 2025-07-16 14:58

NVD link : CVE-2025-6981

Mitre link : CVE-2025-6981

CVE.ORG link : CVE-2025-6981

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-6981", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "product-cna@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-15T21:15:34.630", "references": [{"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.15", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.10", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.6", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.3", "source": "product-cna@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "product-cna@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors API feature was enabled. The Contractors API is a rarely-enabled feature in private preview. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18 and was fixed in versions 3.14.15,\u00a03.15.10,\u00a03.16.6 and\u00a03.17.3"}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n incorrecta permit\u00eda el acceso de lectura no autorizado al contenido de los repositorios internos de las cuentas de contratistas cuando la API de Contratistas estaba habilitada. Esta API es una funci\u00f3n que rara vez se habilita en la vista previa privada. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.18 y se corrigi\u00f3 en las versiones 3.14.15, 3.15.10, 3.16.6 y 3.17.3."}], "lastModified": "2025-07-16T14:58:59.837", "sourceIdentifier": "product-cna@github.com"}