CVE-2025-6981

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

4.3

CVSS v4.0

5.3

EPSS

0.26%

Published

Jul 15, 2025

Modified

Aug 27, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors API feature was enabled. The Contractors API is a rarely-enabled feature in private preview. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18 and was fixed in versions 3.14.15, 3.15.10, 3.16.6 and 3.17.3

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-863

Affected Products (4)

github · enterprise_server (up to 3.14.5)vulnerable

github · enterprise_server (up to 3.15.10)vulnerable

github · enterprise_server (up to 3.16.6)vulnerable

github · enterprise_server (up to 3.17.3)vulnerable

References (4)

https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.15

Release Notes