MEDIUM4.3

GHSA-g376-m3h3-mj4r

Mattermost server allows authenticated user to delete arbitrary post

Quick fix

GHSA-g376-m3h3-mj4r — github.com/mattermost/mattermost/server/v8: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost/server/v8@v8.0.0-20240926115259-20ed58906adc

Details

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost/server/v8

Introduced in: 0Fixed in: 8.0.0-20240926115259-20ed58906adc

Fixgo get github.com/mattermost/mattermost/server/v8@v8.0.0-20240926115259-20ed58906adc

References

https://nvd.nist.gov/vuln/detail/CVE-2024-50052[ADVISORY]
https://github.com/mattermost/mattermost[PACKAGE]
https://mattermost.com/security-updates[WEB]