VDB
Sign up
LOW2.7

GHSA-xfq9-hh5x-xfq9

Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint

Quick fix

GHSA-xfq9-hh5x-xfq9 — github.com/mattermost/mattermost/server/v8: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost/server/v8@v9.11.9

Details

Mattermost versions 9.11.x <= 9.11.8  fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost/server/v8
Introduced in: 9.11.0Fixed in: 9.11.9
Fixgo get github.com/mattermost/mattermost/server/v8@v9.11.9
Go/github.com/mattermost/mattermost/server/v8
Introduced in: 0Fixed in: 8.0.0-20250204211032-f52e08754c49
Fixgo get github.com/mattermost/mattermost/server/v8@v8.0.0-20250204211032-f52e08754c49

References