VNX-GH-217: Outside collaborator with admin access
Someone outside the organisation can change protection, secrets and settings.
Admin access includes disabling branch protection, reading environment configuration and adding deploy keys. Outside collaborators are not covered by the organisation’s 2FA, SSO and offboarding.
| Severity | Medium |
| Confidence | high |
| CWE | CWE-269 |
| Command | vulnetix gha settings, vulnetix gha audit |
| Needs | collaborators. Without them the rule is reported as not evaluated, never as passed. |
Remediation
Reduce outside collaborators to write or lower, or bring them into the organisation.
Run only this rule
vulnetix gha settings --rule VNX-GH-217Scoring
CWSS vector at the rule’s default severity: CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:M/EC:N/P:W. A finding whose severity the repository’s settings moved is scored at its adjusted severity.
All rules: GitHub rules.