What is GHSA-3g35-v53r-gpxc?

GHSA-3g35-v53r-gpxc is a security advisory published by GitHub Security Advisories with Low severity. Mattermost race condition

Which CVE IDs does GHSA-3g35-v53r-gpxc cover?

GHSA-3g35-v53r-gpxc covers the following CVE IDs: CVE-2024-1949. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3g35-v53r-gpxc?

GHSA-3g35-v53r-gpxc has a CVSS v3 base score of 2.6, published by GitHub Security Advisories.

Which products are affected by GHSA-3g35-v53r-gpxc?

GHSA-3g35-v53r-gpxc affects 2 products, including: go/github.com/mattermost/mattermost/server/v8:\u003e= 9.0.0, \u003c 9.4.2; go/github.com/mattermost/mattermost/server/v8:\u003c 8.1.9.

GHSA-3g35-v53r-gpxcLowCVSS 2.6

Mattermost race condition

Vendor

GitHub Security Advisories

Published

February 29, 2024

Last Modified

March 15, 2026

🔗 CVE IDs covered (1)

CVE-2024-1949 →

📋 Description

A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.

🎯 Affected products2

go/github.com/mattermost/mattermost/server/v8:>= 9.0.0, < 9.4.2
go/github.com/mattermost/mattermost/server/v8:< 8.1.9

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-1949
https://mattermost.com/security-updates
https://pkg.go.dev/vuln/GO-2024-2588
https://github.com/advisories/GHSA-3g35-v53r-gpxc