What is GHSA-jhfj-h4g6-q9h9?

GHSA-jhfj-h4g6-q9h9 is a security advisory published by GitHub Security Advisories with Critical severity. A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or...

Which CVE IDs does GHSA-jhfj-h4g6-q9h9 cover?

GHSA-jhfj-h4g6-q9h9 covers the following CVE IDs: CVE-2026-15630. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jhfj-h4g6-q9h9?

GHSA-jhfj-h4g6-q9h9 has a CVSS v3 base score of 9.9, published by GitHub Security Advisories.

GHSA-jhfj-h4g6-q9h9CriticalCVSS 9.9

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or...

Vendor

GitHub Security Advisories

Published

July 23, 2026

Last Modified

July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-15630 →

📋 Description

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-15630
https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz
https://github.com/advisories/GHSA-jhfj-h4g6-q9h9