VDB
Sign up
MEDIUM6.7

GHSA-6xjj-v76v-fwpj

Mattermost does not validate requesting user permissions before updating admin details

Quick fix

GHSA-6xjj-v76v-fwpj — github.com/mattermost/mattermost-server/v6: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost-server/v6@v7.8.8

Details

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost-server/v6
Introduced in: 0Fixed in: 7.8.8
Fixgo get github.com/mattermost/mattermost-server/v6@v7.8.8
Go/github.com/mattermost/mattermost-server/v6
Introduced in: 7.9.0Fixed in: 7.9.6
Fixgo get github.com/mattermost/mattermost-server/v6@v7.9.6
Go/github.com/mattermost/mattermost-server/v6
Introduced in: 7.10.0Fixed in: 7.10.4
Fixgo get github.com/mattermost/mattermost-server/v6@v7.10.4

References