Skip to content
OpenAdvisories
Low · 3.7 CVE-2023-50333 BIT-mattermost-2023-50333EUVD-2024-0319GHSA-9w97-9rqx-8v4jGO-2024-2444

Lack of restriction to manage group names for freshly demoted guests

Published Jan 2, 2024 · Updated Jun 17, 2025 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server Package: github.com/mattermost/mattermost-server/v5 Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server/v8 Ecosystem: Go

Description

Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 9.2.2, ≤ 8.1.6 8.1.7

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server all versions — GO-2024-2444
Go github.com/mattermost/mattermost-server/v5 all versions — GO-2024-2444
Go github.com/mattermost/mattermost-server/v6 all versions — GO-2024-2444
Go github.com/mattermost/mattermost/server/v8 < 8.1.7 8.1.7 GHSA-9w97-9rqx-8v4j
Go github.com/mattermost/mattermost/server/v8 all versions — GO-2024-2444

References