Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

go/github.com/mattermost/mattermost/server/v8Invite ID available to team admins even without the "Add Members" permission

Risk 28
Severity
4.7
EPSS
0.33%
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.

First published (updated )
CVE-2024-29221

go/github.com/mattermost/mattermost/server/v8DoS via a large number of User Preferences

Risk 28
Severity
6.5
EPSS
0.56%
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

First published (updated )
CVE-2024-28949

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203