CVE-2023-3613CWE-863

Guest accounts invited and added to channels by Welcomebot plugin

Low · published July 17, 2023

CVSS v3.1
3.5
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00294 · 20.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-07-17T15:31Z
EPSS history
Timeline
  • 17 JUL 15:31Z
    Guest accounts invited and added to channels by Welcomebot plugin
    cvelistv5