CVE-2024-29221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-29221
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29221.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-29221
Aliases
Published
2024-04-05T09:15:09.680Z
Modified
2026-03-12T02:54:31.798401Z
Severity
  • 3.8 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.

References

Affected packages

Git / github.com/mattermost/mattermost-server

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost-server
Events
Introduced
096c9ea12a2144f832e330e9a0f4d3862ca20b9f
Fixed
45093ef4be396d39748078f9205a88ba5756e0b9
Introduced
7bf5dcb8fb7f05db9a7a6a9be608ac0fe1405351
Fixed
51fdf7ee51c379a80fe852f24f69e463386581d3
Introduced
baa88a2450d49dfea42990861283b5ed9d469edf
Fixed
e5c9444615dc54f49c7c716dce2bbaf81d8cb188
Introduced
99d819d25d0b16b3faed901b1fe5c41de7655e9c
Fixed
9a5b3d30495cb878328cf459850e334b592b3ab8
Database specific 
{
    "versions": [
        {
            "introduced": "8.1.0"
        },
        {
            "fixed": "8.1.11"
        },
        {
            "introduced": "9.3.0"
        },
        {
            "fixed": "9.3.3"
        },
        {
            "introduced": "9.4.0"
        },
        {
            "fixed": "9.4.4"
        },
        {
            "introduced": "9.5.0"
        },
        {
            "fixed": "9.5.2"
        }
    ]
}

Affected versions

@mattermost/client@8.*
@mattermost/client@8.1.1
@mattermost/client@9.*
@mattermost/client@9.3.0
@mattermost/client@9.4.0
@mattermost/client@9.5.0
@mattermost/types@8.*
@mattermost/types@8.1.1
@mattermost/types@9.*
@mattermost/types@9.3.0
@mattermost/types@9.4.0
@mattermost/types@9.5.0
v8.*
v8.1.0
v8.1.0-rc2
v8.1.1
v8.1.1-rc1
v8.1.1-rc2
v8.1.10
v8.1.10-rc1
v8.1.2
v8.1.2-rc1
v8.1.2-rc2
v8.1.3
v8.1.3-rc1
v8.1.3-rc2
v8.1.4
v8.1.4-rc1
v8.1.4-rc2
v8.1.5
v8.1.5-rc1
v8.1.5-rc2
v8.1.6
v8.1.6-rc1
v8.1.7
v8.1.7-rc1
v8.1.7-rc2
v8.1.7-rc3
v8.1.8
v8.1.8-rc1
v8.1.8-rc2
v8.1.9
v8.1.9-rc1
v8.1.9-rc2
v9.*
v9.3.0
v9.3.0-rc2
v9.3.1
v9.3.1-rc1
v9.3.1-rc2
v9.3.2
v9.3.2-rc1
v9.4.0
v9.4.0-rc4
v9.4.1
v9.4.2
v9.4.2-rc1
v9.4.2-rc2
v9.4.3
v9.4.3-rc1
v9.5.0
v9.5.0-rc3
v9.5.1
v9.5.1-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29221.json"