GH-500 · Question #74
What kind of repository permissions do you need to request a Common Vulnerabilities and Exposures (CVE) identification number for a security advisory?
The correct answer is D. Admin. Requesting a CVE identification number through GitHub for a repository security advisory requires Admin-level permissions on that repository. Admin access is required because requesting a CVE is a high-stakes action - it publicly registers a vulnerability in the global CVE…
Question
What kind of repository permissions do you need to request a Common Vulnerabilities and Exposures (CVE) identification number for a security advisory?
Options
- AMaintain
- BWrite
- CTriage
- DAdmin
How the community answered
(42 responses)- A2% (1)
- B2% (1)
- C7% (3)
- D88% (37)
Explanation
Requesting a CVE identification number through GitHub for a repository security advisory requires Admin-level permissions on that repository. Admin access is required because requesting a CVE is a high-stakes action - it publicly registers a vulnerability in the global CVE database and involves coordinating disclosure timelines. Lower permission levels (Write, Triage, Maintain) allow contributors to assist with code, manage issues, or review pull requests, but they do not grant the authority to initiate formal CVE requests. Only repository admins have the full set of security management capabilities, including managing security advisories end-to-end.
Topics
Community Discussion
No community discussion yet for this question.