GHSA-9hj7-v56g-rhf6MediumCVSS 5.4

Mattermost fails to properly authentication inviter's permissions to private channel

Published
March 31, 2023
Last Modified
April 15, 2023

🔗 CVE IDs covered (1)

CVE-2023-1774 →

📋 Description

When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.

Issue Identifier: MMSA-2023-00137

🎯 Affected products5

  • go/github.com/mattermost/mattermost-server:>= 3.3.0, <= 4.10.10
  • go/github.com/mattermost/mattermost-server:>= 7.7.0, <= 7.7.1
  • go/github.com/mattermost/mattermost-server:>= 7.1.0, <= 7.1.5
  • go/github.com/mattermost/mattermost-server/v5:>= 5.0.0, <= 5.39.3
  • go/github.com/mattermost/mattermost-server/v6:>= 6.0.0, <= 6.7.2

🔗 References (3)