VNX-GH-308: Organisation lets Actions approve pull requests

Workflows across the organisation may create and approve pull requests.

Updated 02 Nov 2026Checked against cli@24498404a, vdb-sca-match@v0.8.14

Repositories inherit this permission; a workflow token can then satisfy one-approval rules by approving its own pull request.


Severity	Medium
Confidence	high
CWE	CWE-862
Command	`vulnetix gha org`, `vulnetix gha audit`
Needs	org. Without them the rule is reported as not evaluated, never as passed.

Remediation

Disable “Allow GitHub Actions to create and approve pull requests” at the organisation level.

Run only this rule

vulnetix gha org --rule VNX-GH-308

Scoring

CWSS vector at the rule’s default severity: CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:M/EX:M/EC:N/P:W. A finding whose severity the repository’s settings moved is scored at its adjusted severity.

All rules: GitHub rules.

Edit this pageSources: vdb-sca-match/ghaudit/rules_org.go, cli/internal/ghtasks/docs.go