Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams

GHSA-fxq9-6946-34q7 · BIT-mattermost-2024-42497 · CVE-2024-42497 · GO-2024-3091

Published Aug 22, 2024 · Modified Nov 18, 2024

Description

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-42497
PACKAGE https://github.com/mattermost/mattermost
WEB https://mattermost.com/security-updates

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes