GHSA-vvpg-55p7-5h8wLowCVSS 3.8

Mattermost did not properly restrict channel creation

Published
August 1, 2024
Last Modified
July 25, 2025

🔗 CVE IDs covered (1)

CVE-2024-39837 →

📋 Description

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.

🎯 Affected products7

  • go/github.com/mattermost/mattermost/server/v8:>= 9.5.0, < 9.5.7
  • go/github.com/mattermost/mattermost/server/v8:= 9.9.0
  • go/github.com/mattermost/mattermost/server/v8:< 8.0.0-20240626164322-c758cecaf30c
  • go/github.com/mattermost/mattermost-server:= 9.9.0
  • go/github.com/mattermost/mattermost-server/v5:< 5.3.2-0.20240626164322-c758cecaf30c
  • go/github.com/mattermost/mattermost-server/v6:< 6.0.0-20240626164322-c758cecaf30c
  • go/github.com/mattermost/mattermost-server:>= 9.5.0, < 9.5.7

🔗 References (4)