CVE-2024-4195: Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team…

PriorityP411low2.7CVSS 3.1

AVNACLPRHUINSUCNILAN

EPSS

0.50%

40.0th percentile

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-server	>= 8.1.0 < 8.1.12	8.1.12
github.com	mattermost_mattermost-server	>= 8.1.0+incompatible < 8.1.12+incompatible	8.1.12+incompatible
github.com	mattermost_mattermost-server	>= 9.5.0 < 9.5.3	9.5.3
github.com	mattermost_mattermost-server	>= 9.5.0+incompatible < 9.5.3+incompatible	9.5.3+incompatible
mattermost	mattermost	—	—
mattermost	mattermost	8.1.0 – 8.1.11	—
mattermost	mattermost	9.5.0 – 9.5.2	—
mattermost	mattermost_server	>= 8.1.0 < 8.1.12	8.1.12
mattermost	mattermost_server	>= 9.5.0 < 9.5.3	9.5.3

CVSS provenance

nvdv3.12.7LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vendor_redhat2.7LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.