PkgSeer

Vulnerability GHSA-2g8v-grq3-hq2g

Medium Risk

2 months ago

Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler

v10.11.0+incompatible - v10.11.17+incompatible and v11.5.0+incompatible - v11.5.5+incompatible and v11.6.0+incompatible - v11.6.2+incompatible and v11.7.0+incompatible

Summary

Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler

Details

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler, which allows any authenticated user to overwrite the global default GitLab instance configuration via the {{/gitlab connect }} slash command.. Mattermost Advisory ID: MMSA-2026-00644

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Mattermost doesn't validate file ownership and access control in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5817

Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5818

Mattermost doesn't archive the channel before removing persistent notifications in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5820

Mattermost doesn't validate user-supplied input in API request handlers in github.com/mattermost/mattermost-plugin-github

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5833

Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5835

View all vulnerabilities for these packages

Impacted packages

github.com/mattermost/mattermost-server

Timeline

Published

2 months ago

Last Modified

1 day ago