~ / search / GHSA-5qx9-9ffj-5r8f

GHSA-5qx9-9ffj-5r8f

Mattermost fails to fully validate role changes

Source: GitHub Advisory Database (reviewed) Low CVE-2024-4198

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost-server >= 9.6.0-rc1, < 9.6.1 9.6.1
Go github.com/mattermost/mattermost-server >= 9.5.0, < 9.5.3 9.5.3
Go github.com/mattermost/mattermost-server >= 8.1.0, < 8.1.12 8.1.12

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.

References

External links from the advisory. They lead to third-party sites.