Malicious remote can create/update/delete arbitrary posts in arbitrary channels

published 2024-08-01 2 y ago modified 2026-06-17 4 mo ago also BIT-mattermost-2024-41144 , EUVD-2024-2662 , GHSA-vg67-chm7-8m3j , GO-2024-3023

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits: 0; none known

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled, which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels

Patch / fix

fixed in 5

go github.com/mattermost/mattermost/server/v8 8.0.0-20240619142046-8181a9ddffc0, 9.5.7, 9.7.6, 9.8.2, 9.9.1
go github.com/mattermost/mattermost 5.3.2-0.20240619142046-8181a9ddffc0
bitnami mattermost 9.5.7, 9.7.6, 9.8.2
go github.com/mattermost/mattermost-server 9.5.7+incompatible, 9.7.6+incompatible, 9.8.2+incompatible, 9.9.1+incompatible
Mattermost Mattermost 9.5.7, 9.7.6, 9.8.2, 9.9.1, 9.10.0

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-08-05)

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
GitHub	3.1	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
NVD	3.1	7.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
OSV	3.1	7.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Affected packages

ecosystem	package	affected	fixed in
go	github.com/mattermost/mattermost/server/v8	>=9.5.0, <9.5.7 >=9.7.0, <9.7.6 >=9.8.0, <9.8.2 >=9.9.0, <9.9.1 <8.0.0-20240619142046-8181a9ddffc0 all versions	9.5.7 9.7.6 9.8.2 9.9.1 8.0.0-20240619142046-8181a9ddffc0
go	github.com/mattermost/mattermost	<5.3.2-0.20240619142046-8181a9ddffc0	5.3.2-0.20240619142046-8181a9ddffc0
bitnami	mattermost	>=9.5.0, <9.5.7 >=9.7.0, <9.7.6 >=9.8.0, <9.8.2 >=9.9.0, <=9.9.0	9.5.7 9.7.6 9.8.2
go	github.com/mattermost/mattermost-server	>=9.5.0+incompatible, <9.5.7+incompatible >=9.7.0+incompatible, <9.7.6+incompatible >=9.8.0+incompatible, <9.8.2+incompatible >=9.9.0+incompatible, <9.9.1+incompatible	9.5.7+incompatible 9.7.6+incompatible 9.8.2+incompatible 9.9.1+incompatible
go	github.com/mattermost/mattermost-server/v5	all versions	no fix listed
go	github.com/mattermost/mattermost-server/v6	all versions	no fix listed

Affected products

Mattermost Mattermost

Classification

Weakness

CWE-284 Improper Access Control

References

mattermost.com /security-updates
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2024-41144
advisory, web
github.com /mattermost/mattermost
package
pkg.go.dev /vuln/GO-2024-3023
web
github.com /advisories/GHSA-vg67-chm7-8m3j
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary