CVE-2023-6690: 
GitHub Enterprise Server vulnerability analysis and mitigation

A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the transfer. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1 (NVD).

The vulnerability is classified as a Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367). The CVSS v3.1 base score is 2.0 LOW (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) according to NVD's assessment, while GitHub's assessment gives it a score of 3.9 LOW (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) (NVD).

The vulnerability allows an admin to exploit a race condition to retain permissions on repositories that have been transferred, potentially leading to unauthorized access to transferred repository content (NVD).

The vulnerability has been patched in GitHub Enterprise Server versions 3.8.12, 3.9.7, 3.10.4, and 3.11.1. Organizations should upgrade to these or later versions to mitigate the vulnerability (NVD).