CVE-2024-39777

HIGH

Mattermost 9.5.0-9.5.6 9.7.0-9.7.5 9.8.0-9.8.1 9.9.0 - Improper Access Control via Shared Channel Invite

Title source: llm
STIX 2.1

Description

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin.

References (1)

Core 1
Core References

Scores

CVSS v3 8.7
EPSS 0.0028
EPSS Percentile 51.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-284
Status published
Products (3)
mattermost/mattermost 9.9.0
mattermost/mattermost 9.5.0 - 9.5.7
mattermost/mattermost 9.9.0 - 9.9.1Go
Published Aug 01, 2024
Tracked Since Feb 18, 2026