CVE-2025-6981
📋 TL;DR
An incorrect authorization vulnerability in GitHub Enterprise Server allowed contractor accounts to read internal repository contents when the Contractors API feature was enabled. This affected all versions prior to 3.18, but only impacted systems with the rarely-used Contractors API feature enabled in private preview.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized contractors could exfiltrate sensitive source code, intellectual property, or confidential data from internal repositories, potentially leading to data breaches or competitive disadvantage.
Likely Case
Limited exposure due to the feature being rarely enabled and in private preview, but if exploited, could result in unauthorized access to proprietary code or sensitive information.
If Mitigated
No impact if the Contractors API feature is disabled or if proper access controls and monitoring are in place to detect unauthorized access attempts.
🎯 Exploit Status
Exploitation requires specific configuration (Contractors API enabled) and authenticated contractor access, making widespread exploitation unlikely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.14.15, 3.15.10, 3.16.6, 3.17.3, or any version 3.18+
Vendor Advisory: https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.15
Restart Required: Yes
Instructions:
1. Backup your GitHub Enterprise Server instance. 2. Upgrade to one of the patched versions: 3.14.15, 3.15.10, 3.16.6, 3.17.3, or any version 3.18+. 3. Follow GitHub's upgrade procedures for your specific version. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Disable Contractors API Feature
linuxDisable the Contractors API feature if it's not required for your operations.
Check GitHub Enterprise Server documentation for feature management commands specific to your version
🧯 If You Can't Patch
- Disable the Contractors API feature immediately if enabled
- Implement strict access controls and monitoring for contractor accounts, and review audit logs for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check if GitHub Enterprise Server version is below 3.18 AND the Contractors API feature is enabled. Use the management console or SSH to check version and feature status.Check Version:
ssh admin@your-ghes-instance 'ghes-version' or check via the management consoleVerify Fix Applied:
Verify the version is 3.14.15, 3.15.10, 3.16.6, 3.17.3, or any version 3.18+ using the management console or version check command.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns from contractor accounts to internal repositories
- API calls to contractor-specific endpoints accessing unauthorized repositories
Network Indicators:
- Increased data transfer from GitHub Enterprise Server to contractor-controlled systems
SIEM Query:
source="github-enterprise" AND (user_type="contractor" AND repository_access="internal")🔗 References
- https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.15
- https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.10
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.6
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.3
