Skip to content
OpenAdvisories
Low · 3.1 CVE-2024-21848 BIT-mattermost-2024-21848EUVD-2024-1339GHSA-xp9j-8p68-9q93GO-2024-2707

Users maintain access to active call after being removed from a channel

Published Apr 5, 2024 · Updated Feb 27, 2025 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server Package: github.com/mattermost/mattermost-server/v5 Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server/v8 Ecosystem: Go

Description

Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel

Affected products

VendorProductAffectedFixed
Mattermost Mattermost 8.1.0 – ≤ 8.1.10 9.5.0

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server all versions — GO-2024-2707
Go github.com/mattermost/mattermost-server/v5 all versions — GO-2024-2707
Go github.com/mattermost/mattermost-server/v6 all versions — GO-2024-2707
Go github.com/mattermost/mattermost/server/v8 < 8.1.11 8.1.11 GHSA-xp9j-8p68-9q93
Go github.com/mattermost/mattermost/server/v8 all versions — GO-2024-2707

Advisories 1

References