Skip to content
CVE PROGRAM SOURCE RECORD4.7 Medium

CVE-2024-29221

Invite ID available to team admins even without the "Add Members" permission

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 9.5.0 to ≤ 9.5.1affected
  • 9.4.0 to ≤ 9.4.3affected
  • 9.3.0 to ≤ 9.3.2affected
  • 8.1.0 to ≤ 8.1.10affected
  • 9.6.0unaffected
  • 9.5.2unaffected
  • 9.4.4unaffected
  • 9.3.3unaffected
  • 8.1.11unaffected

References