CVE-2023-1774

Summary

When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost0 <= 7.7.1affected
MattermostMattermost7.7.2unaffected
MattermostMattermost7.8.0unaffected
MattermostMattermost7.1.6unaffected
MattermostMattermost0 <= 7.1.5affected
MattermostMattermost0 < 7.8.0affected

Weaknesses

  • CWE-862: CWE-862 Missing Authorization

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References