Description
Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attacker to specify both a remoteId and the user ID, resulting in creating a user with a user-defined user ID. This can cause some broken functionality in User Management such administrative actions against the user not working.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Mattermost Mattermost
Default version status: unaffected
9.8.0affected9.7.0 to ≤ 9.7.4affected9.6.0 to ≤ 9.6.2affected9.5.0 to ≤ 9.5.5affected9.9.0unaffected9.8.1unaffected9.7.5unaffected9.6.3unaffected9.5.6unaffected