Mattermost allows team admin user without "Add Team Members" permission to disable invite URL

GHSA-3j95-8g47-fpwh · BIT-mattermost-2024-40884 · CVE-2024-40884 · GO-2024-3090

Published Aug 22, 2024 · Modified Nov 18, 2024

Description

Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-40884
PACKAGE https://github.com/mattermost/mattermost
WEB https://mattermost.com/security-updates

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes