VDB
Sign up
LOW3.1

GHSA-rhvr-6w8c-6v7w

Mattermost fails to invalidate all active sessions when converting a user to a bot

Quick fix

GHSA-rhvr-6w8c-6v7w — github.com/mattermost/mattermost/server/v8: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost/server/v8@v8.0.0-20241217145510-faa7e4f2ea0c

Details

Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost/server/v8
Introduced in: 0Fixed in: 8.0.0-20241217145510-faa7e4f2ea0c
Fixgo get github.com/mattermost/mattermost/server/v8@v8.0.0-20241217145510-faa7e4f2ea0c
Go/github.com/mattermost/mattermost/server/v8
Introduced in: 10.4.0-rc1Fixed in: 10.4.2
Fixgo get github.com/mattermost/mattermost/server/v8@v10.4.2
Go/github.com/mattermost/mattermost/server/v8
Introduced in: 9.11.0-rc1Fixed in: 9.11.7
Fixgo get github.com/mattermost/mattermost/server/v8@v9.11.7

References