Skip to main content

Missing Authorization

CVE-2024-50052

Medium
5.3/10

Summary

Mattermost versions 9.5.0-rc1 through 9.5.9, 9.10.0-rc1 through 9.10.2, and 9.11.0-rc1 through 9.11.1, fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post. This issue affects github.com/mattermost/mattermost-plugin-playbooks versions 1.14.0-alpha.1 through 1.39.4.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • NONE

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published