GH_APP_ACCESS

Summary

Forestall ACL Alias

GH_APP_ACCESS

Edge Type

Relationship

Affected Object Types

GitHub Repositories

Exploitation Certainty

N/A (structural)

GitHub Role / Permission

GitHub App installation repository access

Description

GH_APP_ACCESS is a structural relationship recording that a GitHub App installation has access to a repository:

(GHAppInstallation)-[GH_APP_ACCESS]->(GHRepository)

It is created for installations with repository_selection = "selected", linking the app to each specific repository it was granted. (Installations with repository_selection = "all" implicitly reach every org repository; that breadth is captured at the organization level rather than as one edge per repo.)

This edge is the app equivalent of GH_COLLABORATOR (user → repo) and GH_HAS_ACCESS (team → repo): it shows which repositories an app can touch. It is part of the attack surface — compromising the app (its private key or an installation token) yields access to these repositories — but it is structural; the dangerous, admin-level reach is modelled by GH_ADMIN (app → org).

Identification

GitHub Web Interface

Open the organization → Settings → GitHub Apps → an installation → Repository access shows the selected repositories.

GitHub CLI

# repositories accessible to an installation (requires the app's installation token)
gh api "/installation/repositories" --jq '.repositories[].full_name'

Exploitation

Not applicable on its own — GH_APP_ACCESS is structural. The repositories reachable through it become exploitable if the app's credentials are compromised; the impact depends on the app's permission set (read vs write vs admin — see GH_ADMIN).

Mitigation

Scope app repository access narrowly — prefer "only select repositories" over "all repositories".
Grant least permission to the app, so even reachable repos expose minimal capability.
Protect app credentials (private key, installation tokens) and review installations regularly.