Excessive user permissions to a repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_89
Category	Identity Access Management
Severity	HIGH

Impact

A user with 'write' permissions to a repository who has not performed any actions requiring write permissions for more than 90 days, may not require these permissions. This poses a threat, as attackers who gain control of a user account can access the repository which the user potentially should not have 'write' permissions to (as they are not active in the repository), thereby enlarging the surface of the attack.

Recommended Solution - Buildtime

Consider reducing permissions to the necessary minimum:

• Modify user permissions from ‘write’ to ‘read’ OR:
• Remove user permissions entirely if the user does not require access to the repository

For more information about managing access to repositories, refer to: https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/repository-roles-for-an-organization.