CVE-2024-4198: Mattermost fails to fully validate role changes
2.7
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.33937%
CWE
Published
4/26/2024
Updated
4/26/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost-server | go | >= 9.6.0-rc1, <= 9.6.0 | 9.6.1 |
| github.com/mattermost/mattermost-server | go | >= 9.5.0, <= 9.5.2 | 9.5.3 |
| github.com/mattermost/mattermost-server | go | >= 8.1.0, <= 8.1.11 | 8.1.12 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper access control in role validation. The commit diff shows critical changes in UpdateTeamMemberSchemeRoles where:
- Previous checks for guest+user and guest+admin conflicts were removed
- A new check rejecting ANY SchemeGuest assignment was added
- Error messages were updated to indicate guest role changes require system admin
- Test cases were added to verify blocking guest role changes via team API This function was the entry point for team member role updates and lacked proper authorization checks for guest role assignments, allowing team admins to bypass intended restrictions.