We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
| Assigner | Mattermost |
| Reserved | 2024-04-25 |
| Published | 2024-04-26 |
| Updated | 2024-08-01 |
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.
| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
Juho Nurminen
https://mattermost.com/security-updates
