CVSS 3.1
2.7 lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NCVE-2024-4198
Low (2.7) in mattermost mattermost server. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost-server 8.1.12, 8.1.12+incompatible, 9.5.3.
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
- CWE
- CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5qx9-9ffj-5r8f | Go | github.com/mattermost/mattermost-server | >=9.6.0-rc1 <9.6.1 | 9.6.1 |
| GHSA-5qx9-9ffj-5r8f | Go | github.com/mattermost/mattermost-server | >=9.5.0 <9.5.3 | 9.5.3 |
| GHSA-5qx9-9ffj-5r8f | Go | github.com/mattermost/mattermost-server | >=8.1.0 <8.1.12 | 8.1.12 |
| GO-2024-2794 | Go | github.com/mattermost/mattermost-server | >=8.1.0+incompatible <8.1.12+incompatible >=9.5.0+incompatible <9.5.3+incompatible >=9.6.0-rc1+incompatible <9.6.1+incompatible | 8.1.12+incompatible, 9.5.3+incompatible, 9.6.1+incompatible |