CVE-2017-18872 — Incorrect Permission Assignment in Mattermost Mattermost-server

CWE-732 — Incorrect Permission AssignmentCWE-862 — Missing Authorization5 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 64.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Mattermost Mattermost-serverMattermost Server
Timeline
PublishedJun 19
Latest updateOct 30

Description

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDmattermost/mattermost_server4.4.0 — 4.4.3+1
▶Gogithub.com/mattermost_mattermost-server4.4.0-rc1 — 4.4.3+3

🔴Vulnerability Details

4
OSV
Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization in github.com/mattermost/mattermost-server↗2025-10-30
▶
GHSA
Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization↗2022-05-24
▶
OSV
Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization↗2022-05-24
▶
CVEList
CVE-2017-18872: An issue was discovered in Mattermost Server before 4↗2020-06-19
▶
CVE-2017-18872 — Incorrect Permission Assignment | cvebase