CVE-2023-3584: Member can create team with team override scheme
Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-3584?
CVE-2023-3584 is a vulnerability in Mattermost which allows an authenticated attacker to create a new team by bypassing authorization checks.
How does Mattermost fail to check the authorization in POST /api/v4/teams?
Mattermost fails to properly check the authorization in POST /api/v4/teams when passing a team override scheme ID in the request.
What does the vulnerability in Mattermost allow?
The vulnerability in Mattermost allows an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme.
Which versions of Mattermost Server are affected by this vulnerability?
Mattermost Server versions 7.8.0 to 7.8.5 and 7.10.0 to 7.10.3 are affected by this vulnerability.
What is the severity of CVE-2023-3584?
The severity of CVE-2023-3584 is low, with a CVSSv3 score of 3.1.