| Package | Affected versions | Patched versions |
|---|---|---|
| mattermost | ≥ 9.5.0, < 9.5.6≥ 9.6.0, < 9.6.3≥ 9.7.0, < 9.7.5≥ 9.8.0, < 9.8.1 | 9.5.69.6.39.7.59.8.1 |
Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attacker to specify both a remoteId and the user ID, resulting in creating a user with a user-defined user ID. This can cause some broken functionality in User Management such administrative actions against the user not working.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free