CVE-2023-6803

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

A race condition in GitHub Enterprise Server allows an outside collaborator to be added while a repository is being transferred. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-367

Affected software

VendorProductVersions
GitHubEnterprise Server>= 3.8, <= 3.8.11; >= 3.9, <= 3.9.6; >= 3.10, <= 3.10.3; >= 3.11, <= 3.11.0

References

Timeline

Published
Dec 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-68045.5Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workfloCVE-2023-68056.4The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to BlindCVE-2023-68065.4The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Settings user profile fields in all versions up toCVE-2023-68075.4The GeneratePress Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom meta output in all versiCVE-2023-68085.4The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin'sCVE-2023-68095.4The Custom fields shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf shortcode in all versions CVE-2023-68104.3The ClickCease Click Fraud Protection plugin for WordPress is vulnerable to unauthorized access of data due to an improper capability check CVE-2023-68117.2The Language Translate Widget for WordPress – ConveyThis plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key’CVE-2023-68126.1The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20CVE-2023-68136.1The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and iCVE-2023-68145.6Insertion of Sensitive Information into Log File vulnerability in Hitachi Cosminexus Component Container allows local users to gain sensitivCVE-2023-68156.5Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all version
CVE-2023-6803: Medium severity, CVSS 4.0 | Vulnix