Mattermost vulnerable to role promotion exploit

CVE-2024-8071

Summary

A vulnerability exists in certain versions of Mattermost that allows a user with the edit access role to change their permissions to include system administration capabilities. Specifically, this issue arises because the application does not properly restrict the roles that can promote a user to system admin, enabling a role with 'edit' access to manipulate their own permissions. As a result, an unauthorized user may gain elevated privileges, which could lead to unauthorized access to sensitive system settings and critical security configurations.

References