VULNERABILITY INTELLIGENCE

CVE-2024-4198

CVSS score2.7 LOW
EPSS probability0.50%
CISA KEVNot currently listed
Published2024-04-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Description

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-284
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references