GitHub: Bypassing Collaborator Restrictions: Retaining Admin Access Post-Repository Transfer

2023-10-0312:15:12

inspector-ambitious

hackerone.com

$4000

github

security vulnerability

race condition

version 3.8.12

version 3.9.7

version 3.10.4

version 3.11.1

bug bounty

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

A race condition in GitHub Enterprise Server allows an outside collaborator to be added while a repository is being transferred. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.