What is GHSA-3j95-8g47-fpwh?

GHSA-3j95-8g47-fpwh is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost allows team admin user without "Add Team Members" permission to disable invite URL

Which CVE IDs does GHSA-3j95-8g47-fpwh cover?

GHSA-3j95-8g47-fpwh covers the following CVE IDs: CVE-2024-40884. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3j95-8g47-fpwh?

GHSA-3j95-8g47-fpwh has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

Which products are affected by GHSA-3j95-8g47-fpwh?

GHSA-3j95-8g47-fpwh affects 2 products, including: go/github.com/mattermost/mattermost/server/v8:\u003e= 9.5.0, \u003c 9.5.8; go/github.com/mattermost/mattermost/server/v8:\u003e= 9.10.0, \u003c 9.10.1.

GHSA-3j95-8g47-fpwhMediumCVSS 2.7

Mattermost allows team admin user without "Add Team Members" permission to disable invite URL

Vendor

GitHub Security Advisories

Published

August 22, 2024

Last Modified

November 18, 2024

🔗 CVE IDs covered (1)

CVE-2024-40884 →

📋 Description

Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL.

🎯 Affected products2

go/github.com/mattermost/mattermost/server/v8:>= 9.5.0, < 9.5.8
go/github.com/mattermost/mattermost/server/v8:>= 9.10.0, < 9.10.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-40884
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-3j95-8g47-fpwh