GitHub Enterprise Server had two authorization mistakes that matter more than the CVEs themselves: an OAuth consent screen could hide organization runner-management rights, and a separate bug could let authenticated users see private repository source they should not have had access to. In practice, a routine approval or a normal authenticated request could cross a trust boundary the UI was supposed to make clear.
GitHub patched three authenticated issues in versions before 3.21 and 3.22, with fixes in 3.17.17, 3.18.11, 3.19.8, 3.20.4, and later releases up to 3.22. The advisory also includes stored XSS in Discussion titles, but the more operationally important problems are the hidden manage_runners:org scope and the private-source exposure through the Copilot pull request description diff summary endpoint.