CVE-2021-41598
CVE-2021-41598 is a high-severity vulnerability in Github Enterprise Server with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-451.
Key facts
- Severity: High (CVSS 3.x base score 8.8)
- CVSS v2: 6.8
- EPSS exploit prediction: 1% (63rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-451
- Affected product: Github Enterprise Server
- Published:
- Last modified:
Description
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. All permissions being granted would properly be shown during the first authorization, but if the user later updated the set of repositories the app was installed on after the GitHub App had configured additional user-level permissions, those additional permissions would not be displayed, leading to more permissions being granted than the user potentially intended. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.2.5, 3.1.13, 3.0.21. This vulnerability was reported via the GitHub Bug Bounty program.
Frequently asked questions
- What is CVE-2021-41598?
- A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. All permissions being granted would properly be shown during the first authorization, but if the user later updated the set of repositories the app was installed on after the GitHub App had configured additional user-level permissions, those additional permissions would not be displayed, leading to more permissions being granted than the user potentially intended. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.2.5, 3.1.13, 3.0.21. This vulnerability was reported via the GitHub Bug Bounty program.
- How severe is CVE-2021-41598?
- CVE-2021-41598 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2021-41598 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-41598?
- CVE-2021-41598 affects Github Enterprise Server. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2021-41598?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2021-41598 published?
- CVE-2021-41598 was published on 2022-01-25 and last updated on 2026-06-17.
References
- https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.21
- https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.13
- https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.5
Affected products (1)
- cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
More vulnerabilities in Github Enterprise Server
- CVE-2026-8034 — Critical (CVSS 9.8): A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that…
- CVE-2024-6800 — Critical (CVSS 9.8): An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication…
- CVE-2024-4985 — Critical (CVSS 9.8): An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single…
- CVE-2022-23739 — Critical (CVSS 9.8): An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of…
- CVE-2022-46255 — Critical (CVSS 9.8): An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server…
- CVE-2021-22869 — Critical (CVSS 9.8): An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted…
All CVEs affecting Github Enterprise Server →
Other CWE-451 vulnerabilities
- CVE-2026-2634 — Critical (CVSS 9.8): Malicious scripts could cause desynchronization between the address bar and web content before a response is received…
- CVE-2026-0907 — Critical (CVSS 9.8): Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI…
- CVE-2026-0906 — Critical (CVSS 9.8): Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the…
- CVE-2025-8043 — Critical (CVSS 9.8): Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in…
- CVE-2026-11175 — High (CVSS 8.8): Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to…
- CVE-2026-11172 — High (CVSS 8.8): Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to…