Org admin can delete pending invites in different org

Organization admins can delete pending invites created in an organization they are not part of...

GO-2024-3092 Mattermost allows unsolicited invites to expose access to local channels in github.com/mattermost/mattermost-server

Mattermost allows unsolicited invites to expose access to local channels in github.com/mattermost/mattermost-server...

CVE-2024-2232

The lacks CSRF checks allowing a user to invite any user to any group including private groups...

GHSA-Q22Q-2RRF-M27P Mattermost allows unsolicited invites to expose access to local channels

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5 and 9.8.x = 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local...

Mattermost allows unsolicited invites to expose access to local channels

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5 and 9.8.x = 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local...

CVE-2024-39777

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5 and 9.8.x = 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local...

CVE-2024-39777 Malicious remote can invite itself to an arbitrary local channel

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5 and 9.8.x = 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local...

PT-2024-28671 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.9.x through 9.9.0 Mattermost versions 9.5.x through 9.5.6 Mattermost versions 9.7.x through 9.7.5 Mattermost versions 9.8.x through 9.8.1 Description: The issue allows malicious remote users to send unsolicited invites,...

Malicious code in beta-invites (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6774 Malicious code in beta-invites (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in discordjs-invites (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in discord.js-invites (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2100 Malicious code in discord.js-invites (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2024-7453 · Unknown · Matrix-React-Sdk

Name of the Vulnerable Software and Affected Versions: matrix-react-sdk versions 3.18.0 through 3.101.9 Description: The issue is related to insufficient protection of service data, allowing a malicious homeserver to potentially steal message keys for a room when a user invites another user to th...

CVE-2024-27085 Denial of service through invites in Discourse

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

BIT-DISCOURSE-2022-21684 User can bypass approval when invited to Discourse

Discourse is an open source discussion platform. Versions prior to 2.7.13 in stable, 2.8.0.beta11 in beta, and 2.8.0.beta11 in tests-passed allow some users to log in to a community before they should be able to do so. A user invited via email to a forum with mustapproveusers enabled is going to ...

Malicious meeting invite fix targets Mac users

Cybercriminals are targeting Mac users interested in cryptocurrency opportunities with fake calendar invites. During the attacks the criminals will send a link supposedly to add a meeting to the target’s calendar. In reality the link runs a script to install Mac malware on the target’s machine...

PT-2024-18395 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions prior to v8.1.9 Description: Mattermost fails to check the invite guest permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest...

Possibility to circumvent the invitation token expiry period

Impact The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. When using the password reset functionality, the deviseinvitable gem always accepts the pending invitation if the user has been invited as shown in this piece...

PT-2024-18982 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip version 8.0 Description: A vulnerability in Zulip affects installations where non-admins can invite users and create multi-use invitations, but only admins can invite users to streams. This issue allows users to invite new users to...