CVE-2017-18894 — Incorrect Permission Assignment in Mattermost Mattermost-server

CWE-732 — Incorrect Permission AssignmentCWE-639 — Authorization Bypass Through User-Controlled Key5 documents4 sources
Severity
8.1HIGHNVD
EPSS
0.2%
top 56.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Mattermost Mattermost-serverMattermost Server
Timeline
PublishedJun 19
Latest updateJan 13

Description

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶NVDmattermost/mattermost_server4.1.0 — 4.1.1+2
▶Gogithub.com/mattermost_mattermost-server4.1.0+incompatible — 4.1.1+incompatible+5

🔴Vulnerability Details

4
OSV
Mattermost Server has intermittent Authorization bypass for resource-owners in github.com/mattermost/mattermost-server↗2026-01-13
▶
OSV
Mattermost Server has intermittent Authorization bypass for resource-owners↗2022-05-24
▶
GHSA
Mattermost Server has intermittent Authorization bypass for resource-owners↗2022-05-24
▶
CVEList
CVE-2017-18894: An issue was discovered in Mattermost Server before 4↗2020-06-19
▶
CVE-2017-18894 — Incorrect Permission Assignment | cvebase