CVE-2024-1888: Mattermost fails to check the "invite_guest" permission
4.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.25353%
CWE
Published
2/29/2024
Updated
8/7/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | >= 9.4.0, < 9.4.2 | 9.4.2 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.3.0, < 9.3.1 | 9.3.1 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.2.0, < 9.2.5 | 9.2.5 |
| github.com/mattermost/mattermost/server/v8 | go | < 8.1.9 | 8.1.9 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from missing permission checks when re-inviting existing guests across teams. Core team invitation functions in both application logic (TeamService) and API layer (api4) are prime candidates because:
- The description indicates cross-team guest handling is the trigger
- 'InviteUsersToTeam' would be the natural location for invitation authorization checks
- API handlers like inviteUsersToTeam would be the entry point for this operation
- The pattern matches Mattermost's architecture where service layer implements business logic and API layer handles requests
- High confidence comes from the specific scenario described (existing guest reuse) requiring team invitation logic to have conditional permission checks.