-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability description clearly points to an incorrect authorization issue in the /api/v4/channels/{channel_id}/members endpoint, allowing guest users to add members they shouldn't be able to. Analyzing the provided commits, specifically fb9c583f5e466a566a5122154ef337bbf2238902 and ff30b84049f0193f0570d30e46cffc3602298c67, reveals changes in the server/channels/api4/channel.go file within the addChannelMember function. The patch introduces a crucial check using c.App.UserCanSeeOtherUser for each user being added by a guest. The absence of this check in the vulnerable versions is the root cause of the issue. Therefore, the addChannelMember function is the exact location of the vulnerability, and it would be the primary function appearing in a runtime profile during exploitation of this flaw.
addChannelMemberserver/channels/api4/channel.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20250820115038-ff30b84049f0 | 8.0.0-20250820115038-ff30b84049f0 |
| github.com/mattermost/mattermost-server | go | >= 10.5.0, < 10.5.11 | 10.5.11 |
| github.com/mattermost/mattermost-server | go | >= 10.11.0, < 10.11.3 | 10.11.3 |
Ongoing coverage of React2Shell