Description
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled, which allows a malicious remote to add users to arbitrary teams and channels
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Mattermost Mattermost
Default version status: unaffected
9.9.0affected9.5.0 to ≤ 9.5.6affected9.7.0 to ≤ 9.7.5affected9.8.0 to ≤ 9.8.1affected9.10.0unaffected9.9.1unaffected9.5.7unaffected9.7.6unaffected9.8.2unaffected