What is GHSA-hwjf-4667-gqwx?

GHSA-hwjf-4667-gqwx is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost allows attackers access to posts in channels they are not a member of

Which CVE IDs does GHSA-hwjf-4667-gqwx cover?

GHSA-hwjf-4667-gqwx covers the following CVE IDs: CVE-2024-1942. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hwjf-4667-gqwx?

GHSA-hwjf-4667-gqwx has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-hwjf-4667-gqwx?

GHSA-hwjf-4667-gqwx affects 3 products, including: go/github.com/mattermost/mattermost/server/v8:\u003e= 9.3.0, \u003c 9.3.1; go/github.com/mattermost/mattermost/server/v8:\u003e= 9.2.0, \u003c 9.2.5; go/github.com/mattermost/mattermost/server/v8:\u003c 8.1.9.

GHSA-hwjf-4667-gqwxMediumCVSS 4.3

Mattermost allows attackers access to posts in channels they are not a member of

Vendor

GitHub Security Advisories

Published

February 29, 2024

Last Modified

March 19, 2026

🔗 CVE IDs covered (1)

CVE-2024-1942 →

📋 Description

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.

🎯 Affected products3

go/github.com/mattermost/mattermost/server/v8:>= 9.3.0, < 9.3.1
go/github.com/mattermost/mattermost/server/v8:>= 9.2.0, < 9.2.5
go/github.com/mattermost/mattermost/server/v8:< 8.1.9

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-1942
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-hwjf-4667-gqwx