Insecure Direct Object Reference

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API endpoint. This vulnera…CVE-2023-46646GitHub · CVSS 5.3 · 0.5% likely

   CWE-639

2. Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write accessCVE-2026-3306GitHub · CVSS 5.3 · 0.4% likely

   CWE-639

3. Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only accessCVE-2025-8447GitHub · CVSS 7 · 0.3% likely

   CWE-639

4. Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise ServerCVE-2026-5845GitHub · CVSS 7.2 · 0.3% likely

   CWE-639

5. Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collisionCVE-2026-75101GitHub · CVSS 6 · 0.3% likelycovered by CyberSIXT

   CWE-6391 article

6. Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewersCVE-2026-3307GitHub · CVSS 5.3 · 0.3% likely

   CWE-639

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.