Description
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Mattermost Mattermost
Default version status: unaffected
0 to ≤ 7.7.1affected7.7.2unaffected7.8.0unaffected7.1.6unaffected0 to ≤ 7.1.5affected0 to < 7.8.0affected