CVE-2023-5194

Summary

Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost0 <= 8.1.0affected
MattermostMattermost0 <= 7.8.9affected
MattermostMattermost8.1.1unaffected
MattermostMattermost7.8.10unaffected

Weaknesses

  • CWE-863: CWE-863 Incorrect Authorization

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References