Headline
GHSA-9fpw-c9x7-cv3j: Mattermost allows remote actor to set arbitrary RemoteId values for synced users
Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-41926
Mattermost allows remote actor to set arbitrary RemoteId values for synced users
Low severity GitHub Reviewed Published Aug 1, 2024 to the GitHub Advisory Database • Updated Aug 2, 2024
Package
gomod github.com/mattermost/mattermost/server/v8 (Go)
Affected versions
>= 9.5.0, < 9.5.7
= 9.9.0
Patched versions
9.5.7
9.9.1
Published to the GitHub Advisory Database
Aug 1, 2024