CVE-2024-34029

Published: May 26, 2024Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1 and 8.1.x <= 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/<group-id>/channels/<channel-id>/link endpoint which allows a user to learn the members of an AD/LDAP group that is linked to a team by adding the group to a channel, even if the user has no access to the team.

Affected (3)

Products: Mattermost: Mattermost Server

1 product

Mattermost Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mattermost Mattermost Server	From 8.1.0 to 8.1.13
Mattermost Mattermost Server	From 9.5.0 to 9.5.4
Mattermost Mattermost Server	From 9.7.0 to 9.7.2

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://mattermost.com/security-updates

Source: responsibledisclosure@mattermost.com

Vendor Advisory

https://mattermost.com/security-updates

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.