-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper authorization in WebSocket event broadcasting. The pull request #13848 shows critical changes to the sendTeamEvent function in app/team.go, where a teamId filter was added specifically for the 'update_team' event. Prior to this fix, the empty teamId filter caused the event to be broadcasted to all connected users regardless of team membership, violating authorization requirements. The CWE-862 (Missing Authorization) directly maps to this missing access control check in the event broadcasting logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost | go | < 5.20.0 | 5.20.0 |