We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2023-5194

A system/user manager can demote / deactivate another manager



AssignerMattermost
Reserved2023-09-26
Published2023-09-29
Updated2024-09-05

Description

Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager



LOW: 2.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Problem types

CWE-863 Incorrect Authorization

Product status

Default status
0x4003688730

Any version
affected

Any version
affected

8.1.1
unaffected

7.8.10
unaffected

Credits

Pyae Phyo (pyae_phyo) 0x40036887a0

References

https://mattermost.com/security-updates

cve.org CVE-2023-5194

nvd.nist.gov CVE-2023-5194

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2023-5194
Subscribe to our newsletter to learn more about our work.