VDB
Sign up
LOW3.8

GHSA-q8fg-cp3q-5jwm

Mattermost Incorrect Authorization vulnerability

Quick fix

GHSA-q8fg-cp3q-5jwm — github.com/mattermost/mattermost/server/v8: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost/server/v8@v9.11.6

Details

Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost/server/v8
Introduced in: 9.11.0Fixed in: 9.11.6
Fixgo get github.com/mattermost/mattermost/server/v8@v9.11.6
Go/github.com/mattermost/mattermost/server/v8
Introduced in: 0Fixed in: 8.0.0-20250102081831-64c566a8280b
Fixgo get github.com/mattermost/mattermost/server/v8@v8.0.0-20250102081831-64c566a8280b

References