GHSA-wwhj-pw6h-f8hw
Mattermost Incorrect Authorization vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.5.0, < 10.5.2 | 10.5.2 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 9.11.0, < 9.11.10 | 9.11.10 |
| Go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250213231113-68c11e9ecb71 | 8.0.0-20250213231113-68c11e9ecb71 |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation.
References
External links from the advisory. They lead to third-party sites.