← All permissions
Repository permission·administration:write
Administration: Write
Tier 1 · High
Why Tier 1
Changes branch protection and rulesets, adds collaborators and deploy keys, registers runners, and can rename, transfer, make public or delete the repository.
- Target
- Repository
- Plane
- ManagementRepository settings: Repository administration: protection, collaborators, deploy keys, visibility.
- Granted by
- Fine-grained PAT, GitHub App
- Available on
- Every setup
What it unlocks
107 REST endpoints need this permission. A few of them:
- PATCH /repos/{owner}/{repo}
- DELETE /repos/{owner}/{repo}
- PUT /repos/{owner}/{repo}/actions/cache/retention-limit
- PUT /repos/{owner}/{repo}/actions/cache/storage-limit
Roles that include it
- T0OwnerThe organization and every repository in it
- T0All-repository adminEvery repository in the organization
- T1MaintainOne repository
- T1AdminOne repository
- T1Security managerThe organization and every repository in it(in part: Can turn automated security fixes off.)
- T1All-repository maintainEvery repository in the organization
Classic scopes that reach it
- T0repodocumented
- T1delete_repostated by GitHub
Attack paths
Techniques it enables
- Approve your own PR from a second account Submit malicious code
- Bypass or switch off the rules Submit malicious code
- Force push or delete a protected branch Delete code or cover tracks
- Flip private repos to public Read or expose private code
- Add a guest collaborator or new app Keep access
- Register the attacker's machine as a runner Keep access
Escalations it starts
- Flip private repositories to public: Private source code exposed to everyone.
- Register a self-hosted runner: Every job routed to that runner, with the secrets those jobs receive, and a foothold that outlives the stolen token.
- Add a collaborator or guest that outlives the attack: Access that survives password resets and token revocation.
Reached through
- Add yourself to a team with repository access · from The Team maintainer role on a team with repository access
Abused in
Fixed or limited by
- Limit the number of organization owners to the minimum needed
- Restrict public repo creation, visibility changes, repo deletion, private forks and outside collaborator invites to owners
- Run a quarterly access review of owners, repo admins, team membership and outside collaborators
- Review every currently installed GitHub App / OAuth App and its granted scope
- Keep OAuth app access restrictions on and require security/IT approval for new apps
- Enable audit logging and export it to a SIEM for retention and detection
- Branch protection on default/release branches: required reviews + required status checks
- Deletion and force-pushes prevented on critical branches
- CODEOWNERS in place, required on sensitive paths
- Rulesets applied: push restriction, tag protection, sensitive file-path protection
- Require signed commits on the default branch of sensitive repos
- Disallow self-hosted runners on public repositories