A cross‑site request forgery flaw exists in GitHub Enterprise Server that allows an attacker without credentials to cause a signed‑in Management Console operator to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials. The flaw is triggered by a cross‑site GET request lacking a CSRF token, removing vital integration settings that could impede notifications and command execution. The impact is the loss of configuration and disruption of automated chat interactions, but it does not grant arbitrary code execution or data exfiltration.

This vulnerability affects all GitHub Enterprise Server releases prior to 3.23. The issuing advisory lists 3.19.14, 3.20.10, 3.21.8, and 3.22.3 as the patched releases. All versions earlier than these are susceptible.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is not provided and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not been widely exploited yet. The likely attack vector is external; an unauthenticated attacker can trick an authenticated operator into visiting attacker‑controlled content, which then causes the operator’s browser to perform the deletion request. Exploitation requires that ChatOps integrations be configured and that an operator with Management Console access view the malicious content. While the risk is moderate, the potential to disrupt operational workflows warrants timely remediation.