CVE-2023-46647

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to escalate their privileges by making requests to the endpoint used for bootstrapping the instance. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.6, 3.10.3, and 3.11.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
GitHub	Enterprise Server	>= 3.8.0, <= 3.8.11; >= 3.9.0, <= 3.9.5; >= 3.10.0, <= 3.10.3

References

https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.3Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.0Release Notes
https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.6Release Notes
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.3Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.0Release Notes
https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.6Release Notes

Timeline

Published: Dec 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-466487.5An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invit CVE-2023-466497.0A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organizat CVE-2023-46658.8Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira C CVE-2023-466505.4Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a store CVE-2023-466516.5Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configu CVE-2023-466524.3A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enume CVE-2023-466536.5Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting i CVE-2023-466548.1Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup proc CVE-2023-466556.5Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are publish CVE-2023-466565.3Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the pro CVE-2023-466575.3Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook CVE-2023-466585.3Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and