MEDIUM4.3
GHSA-pfw6-5rx3-xh3c
Mattermost fails to check the "invite_guest" permission
Quick fix
GHSA-pfw6-5rx3-xh3c — github.com/mattermost/mattermost/server/v8: upgrade to the fixed version with the command below.
go get github.com/mattermost/mattermost/server/v8@v9.4.2Details
Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another team of the server
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/mattermost/mattermost/server/v8
Introduced in:
9.4.0Fixed in: 9.4.2Fix
go get github.com/mattermost/mattermost/server/v8@v9.4.2Go/github.com/mattermost/mattermost/server/v8
Introduced in:
9.3.0Fixed in: 9.3.1Fix
go get github.com/mattermost/mattermost/server/v8@v9.3.1Go/github.com/mattermost/mattermost/server/v8
Introduced in:
9.2.0Fixed in: 9.2.5Fix
go get github.com/mattermost/mattermost/server/v8@v9.2.5Go/github.com/mattermost/mattermost/server/v8
Introduced in:
0Fixed in: 8.1.9Fix
go get github.com/mattermost/mattermost/server/v8@v8.1.9