# Missing Access Control in MigrationFile allows attacker to upload files to any Migration

Missing authorization on GitHub Enterprise Server migration upload endpoint let any authenticated user overwrite another user's migration archive by supplying its migration identifier.

- Payout: hidden
- Severity: high
- Program: GitHub
- Found by (vendor credit): ahacker1
- Found by: ahacker1
- Disclosed: 2026-03-05
- CVE: CVE-2026-1355
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3506183
- Library page: https://bugbountylibrary.com/r/h1%3A3506183
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:github-actions vuln:access-control vuln:idor

**Target:** Repository migration upload endpoint (MigrationFile)
**Root cause:** The migration upload endpoint failed to verify that the authenticated user owned or had access to the migration identified by the supplied migration identifier, allowing cross-user writes.
**Steps:**
1. Authenticate to the GitHub Enterprise Server instance as any user.
2. Identify a victim's migration identifier.
3. Send an upload request to the migration upload endpoint referencing the victim's migration identifier with attacker-controlled archive content.
4. Victim's migration archive is overwritten/replaced with attacker data.
**Exploitation:** Attacker with any authenticated account supplies a victim's migration identifier to the migration upload endpoint and uploads attacker-controlled content, replacing the victim's migration archive. When the victim restores or imports the migration, they ingest attacker-controlled repository data.
**Insight:** Migration/export endpoints that key off a client-supplied migration ID are prime IDOR targets: test whether uploads to another user's migration ID succeed, since restore/import flows then deliver attacker content to the victim.