DOS4260: Outside Collaborator - Should not have admin permission at the organization level | Security KB - DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.

This website stores cookies on your computer.These cookies are used to collect information about how you interact with our website and allow us to remember you. We use this information to improve and customize your browsing experience and for analytics and metrics about our visitors both on this website and other media. To find out more about the cookies we use, please review our Privacy Policy.

If you decline, your information won’t be tracked when you visit this website. A single cookie will be used in your browser to remember your preference not to be tracked.
By clicking “Accept All”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.

GitHub organization Severitycritical builtIn

Description

Outside (external) collaborators should never have admin permission across the organization. Admin grants the ability to add/remove collaborators, modify protected branches, and access secrets - powers that should be reserved for trusted org members. External collaborators with admin access are a frequent supply-chain attack vector and a top finding in GitHub security audits.

Learn More

https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-outside-collaborators/adding-outside-collaborators-to-repositories-in-your-organization

Recommendation

1. Go to Organization -> Outside collaborators. 
2. For each collaborator, review their permissions. 
3. Downgrade any 'Admin' permission to 'Maintain', 'Write', or lower as appropriate.

Policy Rule

{
  "target": "GHOutsideCollaborator",
  "if": {
    "allOf": [
      {
        "resource": "GHOutsideCollaborator",
        "property": "Permissions.Admin",
        "operator": "notEquals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}

« DOS4250 DOS4265 »

Rule Details

Rule ID: DOS4260
Code: GH_Organization_OutsideCollaborator_Should_Not_Have_Admin
Platform: GitHub
Category: organization
Severity: Severitycritical
Type: builtIn

DOS4260

Outside Collaborator - Should not have admin permission at the organization level

DOS4260

Description

Recommendation

Policy Rule

View evaluation logic (JSON)

Rule Details

Related Rules