← Database

CVE-2024-4198

LOW CVSS: 2.7 Published: 2024-04-26 Modified: 2026-06-17

Description

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.

Affected Platforms

Mattermost Mattermost Server

Weakness Type

CWE-284, NVD-CWE-noinfo

References