# GitHub user to server tokens can create issues in any public repository

GitHub Enterprise Server user-to-server tokens from a GitHub App installation could create issues and comments on any public repo outside the app's granted scope.

- Payout: hidden
- Severity: medium
- Program: GitHub
- Found by (vendor credit): ahacker1
- Found by: ahacker1
- Disclosed: 2026-07-22
- CVE: CVE-2026-14340
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3641229
- Library page: https://bugbountylibrary.com/r/h1%3A3641229
- Tags: area:web domain:api impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:access-control vuln:auth-bypass

**Target:** api.github.com authorization for user-to-server tokens
**Root cause:** Authorization only checked that the token's installation had read permission on the target repo, not that the installation was explicitly granted access to that repo.
**Steps:**
1. Obtain a victim's user-to-server token issued by a global GitHub App installation
2. Send `POST /repos/{owner}/{public-repo}/issues` with the token against a public repo the installation was never granted
3. Observe issue created as the victim user with no app attribution
4. Repeat with issue comments, commit comments, and private vulnerability report endpoints
**How found:** Code review of the authorization check revealed it validated installation read permission rather than explicit repo grant scope for user-to-server tokens.
**Exploitation:** Attacker with a stolen user-to-server token performs write operations (issues, comments, private vuln reports) on arbitrary public repos, impersonating the victim user without revealing app involvement.
**Insight:** When auditing GitHub App token authz, test whether checks validate the installation's repo grant list versus merely the installation's read capability on the target repo — the gap allows cross-repo writes.