VULNERABILITY INTELLIGENCE

CVE-2023-6690

CVSS score3.9 LOW
EPSS probability0.33%
CISA KEVNot currently listed
Published2023-12-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

Description

A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the transfer. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.

Weakness classification

  • product-cna@github.com: CWE-367
  • nvd@nist.gov: CWE-367

Primary references