Authorization Flaw in Mattermost Leading to Uncontrolled Post Deletion
CVE-2024-50052

Currently unrated

Key Information:

Vendor
Mattermost
Status
Mattermost
Vendor
CVE Published:
29 October 2024

Summary

A vulnerability has been identified in Mattermost versions 9.10.x up to 9.10.2, 9.11.x up to 9.11.1, and 9.5.x up to 9.5.9. This issue arises from the lack of validation for the origin of messages in integration actions, allowing an authenticated user to delete any post regardless of ownership. This weakness highlights the importance of proper authorization checks to prevent unauthorized modifications within the application.

References

https://mattermost.com/security-updates

Timeline

  • Vulnerability published

.