CVE-2024-29221: Invite ID available to team admins even without the "Add Members" permission
Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29221?
CVE-2024-29221 has been classified as a high severity vulnerability due to improper access control allowing unauthorized access to sensitive team information.
How do I fix CVE-2024-29221?
To mitigate CVE-2024-29221, upgrade Mattermost Server to versions 9.5.2, 9.4.4, 9.3.3, or 8.1.11 or later.
What versions of Mattermost are affected by CVE-2024-29221?
CVE-2024-29221 affects Mattermost Server versions 9.5.x prior to 9.5.2, 9.4.x prior to 9.4.4, 9.3.x prior to 9.3.3, and 8.1.x prior to 8.1.11.
What specific access control issue does CVE-2024-29221 involve?
CVE-2024-29221 involves improper access control at the '/api/v4/users/me/teams' endpoint, enabling a team admin to retrieve invite IDs that should be restricted.
Is there any workaround for CVE-2024-29221 if I cannot upgrade immediately?
There is no specific workaround for CVE-2024-29221, so upgrading to a fixed version is essential to ensure security.