GHSA-fqrq-xmxj-v47x
Mattermost Fails to Properly Perform Viewer Role Authorization
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost/server/v8 | >= 9.11.0, < 9.11.9 | 9.11.9 |
| Go | github.com/mattermost/mattermost-server | >= 9.11.0, < 9.11.9 | 9.11.9 |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.
References
External links from the advisory. They lead to third-party sites.