Read the researcher's report on HackerOne
A suspended GitHub App could continue accessing public repositories through a scoped user-to-server token. Private repositories were not affected.
How it was found
- The report identifies suspended app installations as the relevant authorization state.
- It reports that a scoped user-to-server token still enabled repository access after suspension.
- The impact was limited to public repositories; the report provides no further testing details.
- Access needed
- A user account · an account
- User interaction
- Not clear
- Whose object
- No object involved
- Boundary crossed
- A suspended app retained access to public repositories through a scoped user-to-server token.
- Root cause
- Suspending an app installation did not revoke or block access mediated by its scoped user-to-server token.
- Impact
- A suspended app could retain access to public repositories, but not private repositories.
- Fix
- The issue was fixed in specified GitHub Enterprise Server releases from versions 3.9.17 through 3.13.1.
- Components
- GitHub App installations, scoped user-to-server tokens, public repositories
- Confidence
- medium
This analysis is CyberSIXT's own summary of the public report, written by a model and checked automatically. It may be wrong: the researcher's report is the source. Written 2026-11-14. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Exfiltrate and mutate repository and project data through injected templated service | A user account | Another tenant's | A regular user imported administrator-only templates that were then installed in projects created by other users. |
| Getting all the CD keys of any game | A user account | Another user's | A partner user retrieved another game's CD keys despite lacking access to that game. |
| Publicly accessible Continuous Integration Tool | No account | No object involved | A public user accessed an internal CI instance and its sensitive data. |
| Attacker is able to access commit title and team member comments which are supposed to be private | A user account | Another user's | A non-team member received email notifications containing activity from a team-only project. |
| Private list members disclosure via GraphQL | A user account | Another user's | A caller accessed another user's private-list membership through GraphQL after discovering its identifier. |
| Exposed proxy allows to access internal reddit domains | No account | No object involved | An unauthenticated external request was reportedly proxied to an internal domain. |
| Organization Takeover | A user account | Another tenant's | A manager changed their membership role in another organization using administrator authority from their own organization. |
| View Titles of Private Reports with pending email invitation | No account | Another user's | An anonymous user read the title of another user's private report by supplying its ID. |
| Account takeover of existing HackerOne accounts through SCIM provisioning | A privileged role | Another user's | An organization member’s account was reassigned to an attacker-controlled email, allowing password reset and account access. |
| Discoverability by phone number/email restriction bypass | No account | The attacker's own | The onboarding flow disclosed an identifier for an account whose discoverability was disabled. |
| Group search leaks private MRs, code, commits | No account | Another user's | Unauthenticated group search exposed content from a private project. |
| Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system. | No account | No object involved | Unauthenticated visitors could access pages intended to be restricted. |