CVE-2024-0507: GitHub Enterprise Server Management Console command injection privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with high EPSS and a privileged management-plane target, though exploitation requires an authenticated editor account and no KEV listing exists.

What it is

GitHub Enterprise Server contains a command injection flaw in the Management Console caused by improper input validation. An authenticated user holding the editor role in the Management Console can exploit it to escalate privileges. All versions were affected until fixes in 3.11.3, 3.10.5, 3.9.8 and 3.8.13.

Impact

An attacker with an editor-level Management Console account gains elevated privileges on the appliance, with high impact to confidentiality, integrity and availability per the CVSS vector. This can lead to full control of the Enterprise Server management plane.

Attack surface

Reached over the network via the Management Console web interface (AV:N, AC:L). It requires a valid authenticated account with the editor role (PR:L) and no user interaction (UI:N).

Exploitation

Not listed in CISA KEV and no public exploit references are provided; EPSS is high at roughly 0.66 (99th percentile), indicating elevated predicted exploitation likelihood. Reference links are release notes only.

What to do

• Upgrade GitHub Enterprise Server to 3.11.3, 3.10.5, 3.9.8 or 3.8.13 as applicable; patch first.
• Restrict and audit which accounts hold the Management Console editor role, applying least privilege.
• Limit network access to the Management Console to trusted administrative networks.
• Enable and review Management Console audit logging for unexpected command or configuration activity.

Detection

• Monitor Management Console audit logs for editor-role accounts performing unusual or unexpected actions.
• Alert on command execution or process spawning from Management Console components on the appliance.
• Review authentication logs for editor-role logins from anomalous source IPs or times.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.