GHSA-rp74-x43m-cpw3
Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.4.0, < 10.4.3 | 10.4.3 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.3.0, < 10.3.4 | 10.3.4 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 9.11.0, < 9.11.9 | 9.11.9 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.5.0, < 10.5.1 | 10.5.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels
References
External links from the advisory. They lead to third-party sites.