CVE-2024-8071: System Role with edit access to permissions can elevate themselves to system admin
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the managesystem permission, effectively becoming a System Admin.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8071?
CVE-2024-8071 is considered a critical vulnerability due to its potential for unauthorized privilege escalation.
How do I fix CVE-2024-8071?
To remediate CVE-2024-8071, upgrade Mattermost to version 9.5.8, 9.8.3, 9.9.2, or 9.10.1 or a later version.
What versions of Mattermost are affected by CVE-2024-8071?
Mattermost versions 9.5.0 to 9.5.7, 9.8.0 to 9.8.2, 9.9.0 to 9.9.1, and 9.10.0 are affected by CVE-2024-8071.
What can an attacker do with CVE-2024-8071?
An attacker with edit access can promote their user role to system admin, potentially allowing them to control the entire system.
Is user role management a concern in CVE-2024-8071?
Yes, CVE-2024-8071 highlights significant flaws in user role management, leading to unauthorized access privileges.