What is GHSA-hgrp-fgm8-56g8?

GHSA-hgrp-fgm8-56g8 is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization

Which CVE IDs does GHSA-hgrp-fgm8-56g8 cover?

GHSA-hgrp-fgm8-56g8 covers the following CVE IDs: CVE-2017-18872. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hgrp-fgm8-56g8?

GHSA-hgrp-fgm8-56g8 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-hgrp-fgm8-56g8?

GHSA-hgrp-fgm8-56g8 affects 2 products, including: go/github.com/mattermost/mattermost-server:\u003c 4.3.3; go/github.com/mattermost/mattermost-server:\u003e= 4.4.0-rc1, \u003c 4.4.3.

GHSA-hgrp-fgm8-56g8MediumCVSS 4.3

Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

October 24, 2025

🔗 CVE IDs covered (1)

CVE-2017-18872 →

📋 Description

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.

🎯 Affected products2

go/github.com/mattermost/mattermost-server:< 4.3.3
go/github.com/mattermost/mattermost-server:>= 4.4.0-rc1, < 4.4.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2017-18872
https://github.com/mattermost/mattermost/commit/8f6bb1570dd234c63de5241eff9fbb268aad358c
https://mattermost.com/security-updates
http://github.com/mattermost/mattermost/commit/753386c2b2b06233d8bd977e3db29a4fe18098cb
https://github.com/advisories/GHSA-hgrp-fgm8-56g8