Description
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 9.6.0, 9.5.0 – ≤ 9.5.2, 8.1.0 – ≤ 8.1.11 | 9.7.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | >= 9.5.0, < 9.5.3 | 9.5.3 | GHSA-5fh7-7mw7-mmx5 |
| Go | github.com/mattermost/mattermost-server | >= 8.1.0, < 8.1.12 | 8.1.12 | GHSA-5fh7-7mw7-mmx5 |
| Go | github.com/mattermost/mattermost-server | >= 8.1.0+incompatible, < 8.1.12+incompatible · >= 9.5.0+incompatible, < 9.5.3+incompatible | 8.1.12+incompatible, 9.5.3+incompatible | GO-2024-2793 |
Advisories 1
- WID-SEC-2024-0718 Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Apr 28, 2024