Management Console access via guessable invitation tokens

Insufficient entropy in GitHub Enterprise Server's Management Console allows remote attackers to brute-force pending user invitations. The invitation-token generator creates tokens with too little unpredictability, exposing a search space that repeated guesses can enumerate; GitHub has not disclosed its implementation. Exploitation requires network access and prior knowledge that an invitation is pending; a successful guess lets the attacker complete that Management Console account and perform most administrative tasks.