Skip to content
OpenAdvisories
Medium · 4.3 CVE-2024-43813 EUVD-2024-40463GHSA-p433-57hw-rf68

IDOR when marking read a user's channel

Published Aug 22, 2024 · Updated Aug 22, 2024 · Assigned by Mattermost

Description

Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any team as read for any user.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost 9.5.0 – ≤ 9.5.7, 9.10.0 9.11.0

References