Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.7

Mattermost lets manager change admin details

CVE-2023-4107 · published 3 years ago
Summary

In Mattermost, a manager role can modify a system administrator's profile, including email and name, because the system does not correctly check the user's permissions. This could let unauthorized changes be made to high‑privilege accounts. Review and update the permission checks or apply the latest patch from the vendor.

What to do
  • Update github.com mattermost to version 7.8.8.
  • Update github.com mattermost to version 7.9.6.
  • Update github.com mattermost to version 7.10.4.
Affected software
Ecosystem VendorProductAffected versions
go github.com mattermost <= 7.8.7
>= 7.9.0, <= 7.9.5
>= 7.10.0, <= 7.10.3
Fix: upgrade to 7.8.8
– mattermost mattermost >= 7.8.0, < 7.8.8
>= 7.9.0, < 7.9.6
>= 7.10.0, < 7.10.4
cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*
Original advisory text
Incorrect authorization allows a user manager to update a system admin
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.7 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
CWE-863Incorrect Authorization
Timeline
Published11 Aug 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-6xjj-v76v-fwpj · GHSA
CVE-2023-4107 · NVD
CVE-2023-4107 · OSV
Track software like this
Free during beta