-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | >= 9.5.0, < 9.5.7 | 9.5.7 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.7.0, < 9.7.6 | 9.7.6 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.8.0, < 9.8.2 | 9.8.2 |
| github.com/mattermost/mattermost/server/v8 | go | = 9.9.0 | 9.9.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper access control during user synchronization in shared channels. Without seeing the exact patch, we infer: 1) The user sync functionality (SyncUser) would be responsible for processing external user data, and 2) The user store's Update method would be the final gatekeeper for persistence. The vulnerability suggests both layers lacked checks to prevent overwriting local users. Confidence is medium as these are common patterns in user management systems, but without commit diffs we can't confirm exact function names.