GHSA-qgwx-rffp-6cx9
Mattermost Fails to Lockout LDAP Users After Repeated Login Failures
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.6.0, < 10.6.2 | 10.6.2 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.5.0, < 10.5.3 | 10.5.3 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.4.0, < 10.4.5 | 10.4.5 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 9.11.0, < 9.11.12 | 9.11.12 |
| Go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250415054241-76ab3867b785 | 8.0.0-20250415054241-76ab3867b785 |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.
References
External links from the advisory. They lead to third-party sites.