Is CVE-2026-3582 actively exploited?

No active exploitation of CVE-2026-3582 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-3582 be exploited remotely?

Yes. CVE-2026-3582 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-3582?

CVE-2026-3582 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-3582

MEDIUM

CVE-2026-3582

CWE-862Published: March 10, 2026· Updated: Mar 12, 2026

4.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.4th

Official Description

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program.

NVD Source

Technical Analysis

CVE-2026-3582 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.