GHSA-fqrq-xmxj-v47x

Suggest an improvement
Source
https://github.com/advisories/GHSA-fqrq-xmxj-v47x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-fqrq-xmxj-v47x/GHSA-fqrq-xmxj-v47x.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-fqrq-xmxj-v47x
Aliases
Published
2025-03-19T15:31:45Z
Modified
2025-03-25T20:08:33.576676Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Mattermost Fails to Properly Perform Viewer Role Authorization
Details

Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.

Database specific
{
    "github_reviewed": true,
    "severity": "MODERATE",
    "nvd_published_at": "2025-03-19T15:15:53Z",
    "cwe_ids": [
        "CWE-863"
    ],
    "github_reviewed_at": "2025-03-19T21:52:19Z"
}
References

Affected packages

Go / github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
9.11.0
Fixed
9.11.9

Go / github.com/mattermost/mattermost-server

Package

Name
github.com/mattermost/mattermost-server
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type
SEMVER
Events
Introduced
9.11.0
Fixed
9.11.9