CVE-2023-6202: Mattermost Improper Access Control vulnerability
4.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.3965%
CWE
Published
11/27/2023
Updated
11/28/2023
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | >= 9.1.0, < 9.1.1 | 9.1.1 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.0.0, < 9.0.2 | 9.0.2 |
| github.com/mattermost/mattermost/server/v8 | go | < 8.1.4 | 8.1.4 |
| github.com/mattermost/mattermost-server/v6 | go | < 7.8.13 | 7.8.13 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability description explicitly identifies the /plugins/focalboard/api/v2/users endpoint as the attack vector. In typical Go web service patterns:
- HTTP handler functions are directly responsible for request authorization
- The vulnerability pattern matches missing permission checks before user data retrieval
- The CWE-284 classification confirms this is an access control issue at the endpoint handler level
- The affected versions' patch notes suggest authorization was added to this endpoint While exact function names aren't provided, the standard implementation would require a handler function like handleGetUser to process user retrieval requests, which would be responsible for performing authorization checks before returning sensitive user data.