VDB
Sign up
LOW2.7

GHSA-rp65-jpc7-8h8p

Mattermost Incorrect Authorization vulnerability

Quick fix

GHSA-rp65-jpc7-8h8p — github.com/mattermost/mattermost/server/v8: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost/server/v8@v8.1.1

Details

Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost/server/v8
Introduced in: 8.1.0Fixed in: 8.1.1
Fixgo get github.com/mattermost/mattermost/server/v8@v8.1.1
Go/github.com/mattermost/mattermost/server/v8
Introduced in: 8.0.0Fixed in: 8.0.2
Fixgo get github.com/mattermost/mattermost/server/v8@v8.0.2
Go/github.com/mattermost/mattermost-server/v6
Introduced in: 0Fixed in: 7.8.10
Fixgo get github.com/mattermost/mattermost-server/v6@v7.8.10

References