Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation

CVE-2023-46647

Summary

An issue exists in all versions of GitHub Enterprise Server that permits users with an editor role in the management console to escalate their privileges. This is achieved by sending requests to an endpoint responsible for the initial bootstrapping of the instance. Notably, the vulnerability affects all versions from 3.8.0 and above, and it has been remediated in version 3.8.12, 3.9.6, 3.10.3, and 3.11.0.

References