CVE-2024-29221CWE-284

Invite ID available to team admins even without the "Add Members" permission

Medium · published April 5, 2024

CVSS v3.1
4.7
EPSS
0%
Percentile
25.0
In the wild
Unconfirmed
What it is

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00331 · 25.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-04-05T08:15Z
EPSS history
Timeline
  • 05 APR 08:15Z
    Invite ID available to team admins even without the "Add Members" permission
    cvelistv5