Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2024-31859

Member promoted to channel admin via playbooks run linking to channel

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel to be promoted to a channel admin

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 9.5.0 to ≤ 9.5.3affected
  • 9.6.0 to ≤ 9.6.1affected
  • 8.1.0 to ≤ 8.1.12affected
  • 9.7.0unaffected
  • 9.5.4unaffected
  • 9.6.2unaffected
  • 8.1.13unaffected

References