VDB
Sign up
MEDIUM5.4

GHSA-9hj7-v56g-rhf6

Mattermost fails to properly authentication inviter's permissions to private channel

Quick fix

GHSA-9hj7-v56g-rhf6 — github.com/mattermost/mattermost-server: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost-server@v7.1.6

Details

When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.

[Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00137

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost-server
Introduced in: 3.3.0Fixed in: 7.1.6
Fixgo get github.com/mattermost/mattermost-server@v7.1.6
Go/github.com/mattermost/mattermost-server
Introduced in: 7.7.0Fixed in: 7.7.2
Fixgo get github.com/mattermost/mattermost-server@v7.7.2
Go/github.com/mattermost/mattermost-server
Introduced in: 7.1.0Fixed in: 7.1.6
Fixgo get github.com/mattermost/mattermost-server@v7.1.6
Go/github.com/mattermost/mattermost-server/v5
Introduced in: 5.0.0Fixed in: 7.1.6
Fixgo get github.com/mattermost/mattermost-server/v5@v7.1.6
Go/github.com/mattermost/mattermost-server/v6
Introduced in: 6.0.0Fixed in: 7.1.6
Fixgo get github.com/mattermost/mattermost-server/v6@v7.1.6

References