CVE-2023-4107CWE-863

Incorrect authorization allows a user manager to update a system admin

Medium · published August 11, 2023

CVSS v3.1
6.7
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00508 · 42.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-08-11T06:12Z
EPSS history
Timeline
  • 11 AUG 06:12Z
    Incorrect authorization allows a user manager to update a system admin
    cvelistv5