# CVE-2024-10824: Authorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert Data

> CVE-2024-10824: Authorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert Data. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2024-10824
Last updated: 2026-06-17T06:56:30Z

- Published: 2024-11-07 21:15 UTC · Updated: 2026-06-17 06:56 UTC · Assigner: GitHub\_P
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.34%, 28th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-862

## Description

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning alert data intended only for business owners. This issue could be exploited only by organization members with a personal access token (PAT) and required that secret scanning be enabled on user-owned repositories. This vulnerability affected GitHub Enterprise Server versions after 3.13.0 but prior to 3.14.0 and was fixed in version 3.13.2.

## Affected vendors and products

- GitHub: Enterprise Server

## Tracked companies

- [GitHub](https://rewindex.com/company/github.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2024-10824)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2024-10824)
- [https://docs.github.com/en/enterprise-server@3.13/admin/release-notes\#3.13.2](https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.2)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2024-10824 · Markdown: https://rewindex.com/cve/CVE-2024-10824.md · JSON: https://rewindex.com/api/v1/cves/CVE-2024-10824 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:17:01.446Z