Veracode Vulnerability DatabaseVERACODE:40588Incorrect Authorization
EPSS
Percentile
40.0%
github.com/mattermost/mattermost-server is vulnerable to Incorrect Authorization. The vulnerability exists because the createUserAccessToken function of user.go fails to restrict a user with permission to edit other users and to create personal access tokens from elevating their privileges to the system admin.
References
github.com/advisories/GHSA-7g2v-2frm-rg94
github.com/mattermost/mattermost-server/commit/4cc26a9abeabdcda719f72e28bc4edf6c3f88fde
github.com/mattermost/mattermost-server/commit/7f55c545390c91f8cd4b6996defe3c6b76b2bd5f
github.com/mattermost/mattermost-server/commit/9ddea0e90aa896c0be04bc00ef1c6cdc838c8458
github.com/mattermost/mattermost-server/commit/a3d8e58733e09dbd2a523db9ac82a7772f9125b4
github.com/mattermost/mattermost-server/commit/dcab64f9d03307e91150c4a8246fa6a7a670f133
mattermost.com/security-updates
mattermost.com/security-updates/
Related
