CVE-2024-4198CWE-284

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin…

Low · published April 26, 2024

CVSS v3.1
2.7
EPSS
1%
Percentile
42.1
In the wild
Unconfirmed
What it is

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00502 · 42.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-04-26T08:26Z
EPSS history
Timeline
  • 26 APR 08:26Z
    Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin…
    cvelistv5