2.7
Low
CVE-2024-4195 Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows…
Description
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Mattermost 9.7 | earliest → < 9.7.0 | 9.7.0 |
| Mattermost | 9.6.0 | 9.6.1 |
| Mattermost 9.5 | 9.5.0 → 9.5.2 | 9.5.3 |
| Mattermost 8.1 | 8.1.0 → 8.1.11 | 8.1.12 |
| mattermost 9.7 | earliest → < 9.7.0 | 9.7.0 |
| mattermost | 9.6.0 | 9.6.1 |
| mattermost | 9.5.0 | 9.5.3 |
| mattermost | 8.1.0 | 8.1.12 |