Vulnerability · Published Apr 5, 2024 · Assigned by Mattermost
CVE-2024-29221Invite ID available to team admins even without the "Add Members" permission
Medium 4.7
In plain English
A medium-severity improper access control in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | 9.3.3+incompatible, 9.4.4+incompatible, 9.5.2+incompatible | GO-2024-2706 |
| Go | github.com/mattermost/mattermost-server/v5 | no fix listed | GO-2024-2706 |
| Go | github.com/mattermost/mattermost-server/v6 | no fix listed | GO-2024-2706 |
| Go | github.com/mattermost/mattermost/server/v8 | 9.3.3 | GHSA-w67v-ph4x-f48q |
| Go | github.com/mattermost/mattermost/server/v8 | 8.1.11 | GHSA-w67v-ph4x-f48q |
| Go | github.com/mattermost/mattermost/server/v8 | no fix listed | GO-2024-2706 |
| Go | github.com/mattermost/mattermost/server/v8 | 9.5.2 | GHSA-w67v-ph4x-f48q |
| Go | github.com/mattermost/mattermost/server/v8 | 9.4.4 | GHSA-w67v-ph4x-f48q |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 9.5.0 – through 9.5.19.4.0 – through 9.4.39.3.0 – through 9.3.28.1.0 – through 8.1.10 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L