~ / search / GHSA-w67v-ph4x-f48q

GHSA-w67v-ph4x-f48q

Mattermost Server Improper Access Control

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-29221

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost/server/v8 >= 8.1.0, < 8.1.11 8.1.11
Go github.com/mattermost/mattermost/server/v8 >= 9.5.0, < 9.5.2 9.5.2
Go github.com/mattermost/mattermost/server/v8 >= 9.4.0, < 9.4.4 9.4.4
Go github.com/mattermost/mattermost/server/v8 >= 9.3.0, < 9.3.3 9.3.3

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.

References

External links from the advisory. They lead to third-party sites.