CVSS 3.1
4.6 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NCVE-2022-1385
Medium (4.6) in mattermost mattermost server. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost-server/v6 6.5.0.
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-668, CWE-664
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fxwj-v664-wv5g | Go | github.com/mattermost/mattermost-server/v6 | <6.5.0 | 6.5.0 |
| GO-2022-0599 | Go | github.com/mattermost/mattermost-server | all versions | no fix published |
| GO-2022-0599 | Go | github.com/mattermost/mattermost-server/v5 | all versions | no fix published |
| GO-2022-0599 | Go | github.com/mattermost/mattermost-server/v6 | <6.5.0 | 6.5.0 |