low2.7
CVE-2024-4198
Mattermost fails to fully validate role changes
Impact
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost-server | >= 9.6.0-rc1, <= 9.6.0 | 9.6.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | from 8.1.0 before 8.1.12 from 9.5.0 before 9.5.3 Version 9.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://mattermost.com/security-updates
- https://github.com/advisories/GHSA-5qx9-9ffj-5r8f
- https://nvd.nist.gov/vuln/detail/CVE-2024-4198
- https://github.com/mattermost/mattermost/commit/3d6d8a7c1f7105558fe266a1b379859a4dba4e9b
- https://github.com/mattermost/mattermost/commit/408ce4a82bb55ce27801f7044d9b3b49e82c47ed
- https://github.com/mattermost/mattermost/commit/fba5b8e348feada9b21290369c3598ccd5c04424