CVE-2023-1774

MEDIUM

Mattermost Server < 7.1.6 - Missing Authorization for Private Channel Email Invites

Title source: llm

Description

When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.

References (1)

Core 1

Core References

Vendor Advisory

https://mattermost.com/security-updates/

Scores

CVSS v3 4.2

EPSS 0.0016

EPSS Percentile 36.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (5)

mattermost/mattermost-server 3.3.0 - 7.1.6Go

mattermost/mattermost-server 5.0.0 - 7.1.6Go

mattermost/mattermost-server 6.0.0 - 7.1.6Go

mattermost/mattermost_server 7.7.1

mattermost/mattermost_server < 7.1.6

Published Mar 31, 2023

Tracked Since Feb 18, 2026