GHSA-p6gj-jc38-x2m7
Mattermost fails to validate user permissions when deleting comments in Boards
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost/server/v8 | <= 8.0.0-20251013062617-7977e7e6dae3 | no fix listed |
| Go | github.com/mattermost/mattermost | >= 10.11.0, <= 10.11.4 | no fix listed |
| Go | github.com/mattermost/mattermost | >= 10.12.0, <= 10.12.1 | no fix listed |
| Go | github.com/mattermost/mattermost | >= 10.5.0, <= 10.5.12 | no fix listed |
| Go | github.com/mattermost/mattermost | >= 11.0.0, <= 11.0.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.
References
External links from the advisory. They lead to third-party sites.