CVE-2024-31859: Member promoted to channel admin via playbooks run linking to channel

Q: What is the severity of CVE-2024-31859?

CVE-2024-31859 has a medium severity rating due to improper authorization checks in Mattermost.

Q: How do I fix CVE-2024-31859?

To fix CVE-2024-31859, upgrade Mattermost to the latest version that addresses the authorization vulnerabilities.

Q: What versions of Mattermost are affected by CVE-2024-31859?

CVE-2024-31859 affects Mattermost versions 9.5.x up to 9.5.3, 9.6.x up to 9.6.1, and 8.1.x up to 8.1.12.

Q: What type of vulnerability is CVE-2024-31859?

CVE-2024-31859 is an authorization bypass vulnerability that allows unauthorized promotion to channel admin.

Q: Who can be impacted by CVE-2024-31859?

Members running a playbook in affected Mattermost channels can be impacted by being improperly promoted to channel admins.

Published May 26, 2024

Updated

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel to be promoted to a channel admin

Affected Software

4 affected components

Mattermost Mattermost<=9.5.3, <=9.6.1, <=8.1.12

Mattermost Mattermost Server>=8.1.0<8.1.13

Mattermost Mattermost Server>=9.5.0<9.5.4

Mattermost Mattermost Server>=9.6.0<9.6.2

Remediation

Information

Update Mattermost to versions 9.7.0, 9.5.4, 9.6.2, 8.1.13 or higher.

Event History

May 26, 2024

CVE Published

via MITRE·01:31 PM

Data Sourced

via MITRE·01:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-31859?

CVE-2024-31859 has a medium severity rating due to improper authorization checks in Mattermost.

How do I fix CVE-2024-31859?