VULNERABILITY INTELLIGENCE

CVE-2023-4478

CVSS score4.3 MEDIUM
EPSS probability0.50%
CISA KEVNot currently listed
Published2023-08-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Description

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-74
  • nvd@nist.gov: CWE-74

Primary references