GHSA-9fpw-c9x7-cv3jMediumCVSS 2.7

Mattermost allows remote actor to set arbitrary RemoteId values for synced users

Published
August 1, 2024
Last Modified
July 9, 2025

🔗 CVE IDs covered (1)

CVE-2024-41926 →

📋 Description

Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.

🎯 Affected products4

  • go/github.com/mattermost/mattermost/server/v8:>= 9.5.0, < 9.5.7
  • go/github.com/mattermost/mattermost/server/v8:= 9.9.0
  • go/github.com/mattermost/mattermost/server/v8:< 8.0.0-20240604093018-5114c3b7cdb8
  • go/github.com/mattermost/mattermost:< 5.3.2-0.20240604093018-5114c3b7cdb8

🔗 References (5)