Executive Summary

Mattermost Plugin Legal Hold versions up to 1.1.4 have a vulnerability where the plugin fails to stop processing requests after an authorization check fails in the ServeHTTP function.

This flaw allows an authenticated attacker to bypass authorization controls and perform unauthorized actions such as accessing, creating, downloading, and deleting legal hold data by sending specially crafted API requests to the plugin's endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows an authenticated attacker to gain unauthorized access and control over sensitive legal hold data.

• Access sensitive legal hold information without proper authorization.
• Create or modify legal hold data, potentially corrupting or falsifying records.
• Download confidential legal hold data, leading to data leakage.
• Delete legal hold data, which could result in loss of critical evidence or records.

Overall, this can compromise the integrity, confidentiality, and availability of legal hold data.

Useful 0 Not Useful 0