Medium · 4.2 CVE-2023-2784 EUVD-2023-34240GHSA-8jf2-78m7-7f8v

Apps Framework allows install requests from regular members via an internal path

Published Jun 16, 2023 · Updated Dec 6, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost App Framework

Description

Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests to the Apps.

Affected products

Vendor	Product	Affected	Fixed
Mattermost	Mattermost App Framework	≤ 7.8.4, ≤ 7.9.3, 7.10.0	v7.8.5

References

https://mattermost.com/security-updates