GH_PARENT

Summary

Forestall ACL Alias	GH_PARENT
Edge Type	Relationship
Affected Object Types	GitHub Organizations, GitHub Users, GitHub Teams, GitHub Repositories, GitHub App Installations, GitHub Organization Roles
Exploitation Certainty	N/A (structural)
GitHub Role / Permission	Enterprise / organization ownership / containment

Description

GH_PARENT is a structural containment relationship: it records that a parent owns (contains) one of its child objects. Direction is always parent → child:

(GHEnterprise)-[GH_PARENT]->(GHOrganization)
(GHOrganization)-[GH_PARENT]->(GHUser | GHTeam | GHRepository | GHAppInstallation | GHOrgRole)

It covers every object that lives inside an enterprise or organization:

• Enterprise → Org — the organization belongs to the GitHub Enterprise account.

• Org → User — the user is a member of the organization.

• Org → Team — the team belongs to the organization.

• Org → Repository — the organization owns the repository.

• Org → App Installation — the GitHub App is installed in the organization.

• Org → Org Role — the (predefined or custom) role is defined within the organization.

This is the backbone of the enterprise → organization → object hierarchy. It is not a traversable attack path — being contained by an organization is not "control" over anything (a plain member does not control the org). The privileged relationships are modelled by separate edges (GH_OWNER, GH_ADMIN, GH_MANAGE_ROLES, etc.); GH_PARENT simply describes where each object sits.

Identification

GitHub Web Interface

In the enterprise account, Settings → Organizations lists every org owned by the enterprise (each is a child via GH_PARENT). Within an organization, browse People (users), Teams, Repositories, Installed GitHub Apps, and Organization roles — every listed object is a child of the org via GH_PARENT.

GitHub CLI

gh api "enterprises/{enterprise}/org-properties/values" --paginate --jq '.[].organization_login'
gh api "orgs/{org}/members" --paginate --jq '.[].login'
gh api "orgs/{org}/teams" --paginate --jq '.[].slug'
gh api "orgs/{org}/repos" --paginate --jq '.[].full_name'
gh api "orgs/{org}/installations" --jq '.installations[].app_slug'
gh api "orgs/{org}/organization-roles" --jq '.roles[].name'

Exploitation

Not applicable — GH_PARENT is a structural containment relationship, not a traversable attack path. It is excluded from shadow-admin path-finding for exactly this reason.

Mitigation

Not applicable directly. Containment is inherent to the organization. Manage the privileged relationships layered on top of it (ownership, admin, role management) rather than GH_PARENT itself.

References

• https://docs.github.com/en/organizations/collaborating-with-groups-in-organizations/about-organizations