Invite ID available to team admins even without the "Add Members" permission

Summary

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.

Timeline

1. Apr 5, 2024, 8:15 AM UTCCVE published
2. Apr 9, 2024, 5:16 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Aug 2, 2024, 1:10 AM UTCRecord last updated

Affected versions

• Mattermost Mattermost

  From 9.5.0 · through 9.5.1; From 9.4.0 · through 9.4.3; From 9.3.0 · through 9.3.2; From 8.1.0 · through 8.1.10

• github.com/mattermost/mattermost-serverGo

  From 9.3.0+incompatible · fixed in 9.3.3+incompatible; From 9.4.0+incompatible · fixed in 9.4.4+incompatible; From 9.5.0+incompatible · fixed in 9.5.2+incompatible

• github.com/mattermost/mattermost-server/v5Go

  All versions

• github.com/mattermost/mattermost-server/v6Go

  All versions

• github.com/mattermost/mattermost/server/v8Go

  All versions

• github.com/mattermost/mattermost/server/v8Go

  From 8.1.0 · fixed in 8.1.11

• github.com/mattermost/mattermost/server/v8Go

  From 9.5.0 · fixed in 9.5.2

• github.com/mattermost/mattermost/server/v8Go

  From 9.4.0 · fixed in 9.4.4

• github.com/mattermost/mattermost/server/v8Go

  From 9.3.0 · fixed in 9.3.3

References 1