Skip to content
Forestall

GH_OWNER

Copy page

Summary
Forestall ACL Alias GH_OWNER
Edge Type Attack Path
Affected Object Types GitHub Organizations
Exploitation Certainty Certain
GitHub Role / Permission Organization owner role

Description

GH_OWNER represents that a user holds the owner role on a GitHub organization. The owner role is the highest level of privilege in a GitHub organization — equivalent to AWS’s AdministratorAccess (AWS_ADMIN) or Active Directory’s Domain Admin.

An organization owner has unrestricted control over every resource and setting in the organization:

  • Full administrative access to all repositories, including private ones, regardless of explicit repository grants.
  • Ability to add or remove members, grant or revoke the owner role, and manage all teams.
  • Control over organization-wide security policy — two-factor authentication enforcement, default repository permissions, and member privileges.
  • Access to all organization secrets and the ability to configure webhooks, GitHub Apps, and SSO/SAML settings.

Because an owner can already reach every asset in the organization, this edge is a terminal attack path — once an attacker controls an owner account, no further traversal is required to compromise the organization.

This edge is computed from the organization role returned by the GitHub API: a user whose membership role is admin (surfaced as owner in the organization UI) is connected to the organization via GH_OWNER.

Identification

GitHub Web Interface

  1. Navigate to your GitHub Organization page.
  2. Open the People tab.
  3. Use the Role filter and select Owner to list all organization owners.

Exploitation

There is no multi-step exploit required — the owner role is full control. An attacker who compromises an owner account (through a stolen password, a missing 2FA factor, a leaked Personal Access Token, or session theft) immediately gains organization-wide administrative access.

Typical actions following owner compromise:

  1. Access every repository. Clone all private source code, including repositories the account was never explicitly added to.

    gh repo list {org} --limit 1000
    gh repo clone {org}/{repo}

  2. Establish persistence. Promote an attacker-controlled account to owner, or invite a new member and grant the owner role.

    gh api --method PUT "orgs/{org}/memberships/{attacker}" -f role=admin

  3. Weaken security controls. Disable the 2FA requirement, lower the default repository permission, or remove branch protection to enable further attacks.

  4. Exfiltrate secrets and pivot. Read organization and repository secrets, then use CI/CD or OIDC federation to pivot into connected cloud environments.

Mitigation

  1. Minimize the number of owners. Keep the owner role to the smallest possible set. Every owner is a full-organization compromise risk.

    • Navigate to Organization → People, filter by Owner, and downgrade anyone who does not require organization-wide administration to Member.

  2. Require two-factor authentication for owners. Owner accounts without 2FA are the single highest-value target. Enforce 2FA org-wide (see FS6011).

  3. Use teams and repository roles for day-to-day access instead of granting the owner role. Most administrative tasks can be delegated through custom organization roles or team maintainer rights.

  4. Review owners regularly. Treat the owner list as a Tier-0 asset and audit it on a fixed cadence, removing accounts that no longer need the role.

  5. Protect owner credentials. Require hardware security keys for owners and rotate any Personal Access Tokens with admin:org scope.

Detection

Monitor the GitHub audit log for changes to organization ownership:

Event Description
org.update_member A member’s role was changed (e.g., promoted to owner)
org.add_member A member was added to the organization
org.invite_member A user was invited to the organization
business.add_admin An enterprise/organization administrator was added

Alert on any promotion to the owner role, especially when performed outside of an approved change process. Cross-reference with the actor: an unexpected actor promoting an account to owner is a strong indicator of compromise.

References

Was this page helpful?

Thank you for your feedback.