Malicious remote can make an arbitrary local channel read-only

Summary

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are enabled, which allows a malicious remote to make an arbitrary local channel read-only.

Timeline

1. Aug 1, 2024, 2:05 PM UTCCVE published
2. Aug 2, 2024, 2:45 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Aug 2, 2024, 3:01 PM UTCRecord last updated

Affected versions

• Mattermost Mattermost

  From 9.5.0 · through 9.5.6; From 9.7.0 · through 9.7.5; From 9.8.0 · through 9.8.1

• github.com/mattermost/mattermost/server/v8Go

  From 9.5.0 · fixed in 9.5.7

• github.com/mattermost/mattermost/server/v8Go

  From 9.7.0 · fixed in 9.7.6

• github.com/mattermost/mattermost/server/v8Go

  From 9.8.0 · fixed in 9.8.2

• github.com/mattermost/mattermost/server/v8Go

  From 9.9.0 · fixed in 9.9.1

• github.com/mattermost/mattermost/server/v8Go

  fixed in 8.0.0-20240628125750-70b218839fa7

• github.com/mattermost/mattermostGo

  fixed in 5.3.2-0.20240628125750-70b218839fa7

• github.com/mattermost/mattermost-serverGo

  From 9.5.0+incompatible · fixed in 9.5.7+incompatible; From 9.7.0+incompatible · fixed in 9.7.6+incompatible; From 9.8.0+incompatible · fixed in 9.8.2+incompatible; From 9.9.0+incompatible · fixed in 9.9.1+incompatible

• github.com/mattermost/mattermost-server/v5Go

  All versions

• github.com/mattermost/mattermost-server/v6Go

  All versions

• github.com/mattermost/mattermost/server/v8Go

  All versions

References 1