Improper Access Control

2024-03-0104:53:07

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

mattermost

access control

vulnerability

guests

team

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

9.0%

JSON

Mattermost is vulnerable to Improper Access Control. The vulnerability is due to an improper check of the invite_guest permission, allowing a member with permissions to add other members but not to add guests to add a guest to a team, provided the guest was already a guest in another team of the server.