Description (CNA)
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Mattermost / Mattermost | affected 10.5.0 through 10.5.5; affected 9.11.0 through 9.11.15; affected 10.8.0; affected 10.7.0 through 10.7.2; affected 10.6.0 through 10.6.5; unaffected 10.9.0; unaffected 10.5.6; unaffected 9.11.16; unaffected 10.8.1; unaffected 10.7.3; unaffected 10.6.6 |
CWE
CWE-863
References
ADP enrichment
No English description supplied.
No references supplied.