Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-50052: Mattermost lets any logged‑in user delete any message

CVE-2024-50052 · published 2 years ago

Summary

Versions of Mattermost Server up to 9.10.2, 9.11.1 and 9.5.9 do not verify that a delete request comes from the original author. This means a user who is signed in could remove posts they did not create, potentially disrupting conversations. Update to the latest Mattermost release or apply the provided patch to restore proper checks.

What to do

Update github.com mattermost to version 8.0.0-20240926115259-20ed58906adc.

Affected software

Ecosystem	Vendor	Product	Affected versions
go	github.com	mattermost	< 8.0.0-20240926115259-20ed58906adc Fix: upgrade to 8.0.0-20240926115259-20ed58906adc
–	mattermost	mattermost_server	>= 9.5.0, < 9.5.10 >= 9.10.0, < 9.10.3 >= 9.11.0, < 9.11.2 `cpe:2.3:a:mattermost:mattermost_server::::::::`

Original advisory text

Arbitrary post deletion via Playbooks /ignore-thread endpoint

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.

References

https://github.com/advisories/GHSA-g376-m3h3-mj4r
https://mattermost.com/security-updates URL
https://nvd.nist.gov/vuln/detail/CVE-2024-50052 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50052... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published29 Oct 2024

Updated3 Nov 2026

First seen6 Mar 2026

Sources

GHSA-g376-m3h3-mj4r · GHSA

CVE-2024-50052 · NVD

CVE-2024-50052 · OSV

Track software like this

Free during beta