Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

{
                    "vendor": "GitHub",
                    "product": "Enterprise Server",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "3.18.0",
                            "lessThan": "3.18.*",
                            "changes": [
                                {
                                    "at": "3.18.16",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "3.19.0",
                            "lessThan": "3.19.*",
                            "changes": [
                                {
                                    "at": "3.19.13",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "3.20.0",
                            "lessThan": "3.20.*",
                            "changes": [
                                {
                                    "at": "3.20.9",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "3.21.0",
                            "lessThan": "3.21.*",
                            "changes": [
                                {
                                    "at": "3.21.7",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "3.22.0",
                            "lessThan": "3.22.*",
                            "changes": [
                                {
                                    "at": "3.22.2",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unknown"
                }