System Role with edit access to permissions can elevate themselves to system admin
Vulnerability Description
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8071
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- BhaRat (hackit_bharat)
References
More from Mattermost
View All →Affected Vendor
Mattermost
View all reports →