Mattermost allows unsolicited invites to expose access to local channels
High severity
GitHub Reviewed
Published
Aug 1, 2024
to the GitHub Advisory Database
•
Updated Aug 23, 2024
Package
Affected versions
>= 9.9.0, < 9.9.1
>= 9.5.0, < 9.5.7
>= 9.7.0, < 9.7.6
>= 9.8.0, < 9.8.1
Patched versions
9.9.1
9.5.7
9.7.6
9.8.1
Description
Published by the National Vulnerability Database
Aug 1, 2024
Published to the GitHub Advisory Database
Aug 1, 2024
Reviewed
Aug 23, 2024
Last updated
Aug 23, 2024
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin.
References