Executive Summary

This vulnerability affects Mattermost versions 11.7.x up to 11.7.0 and 10.11.x up to 10.11.17. It occurs because the software fails to enforce bot-specific permission checks on the user active status endpoint.

Specifically, a User Manager who has user management write access but does not have Integrations access can deactivate bot accounts by using the PUT /api/v4/users/{id}/active API endpoint.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a User Manager without Integrations access to deactivate bot accounts, which they should not normally be able to do.

This could lead to disruption of automated processes or integrations that rely on bot accounts, potentially impacting system functionality or workflows.

The CVSS score of 3.8 indicates a low to medium severity impact, with no confidentiality loss but some integrity and availability impact.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update Mattermost to a version later than 11.7.0 or 10.11.17 where the issue is fixed.

Additionally, review and restrict User Manager permissions to ensure that users with user management write access do not have unintended abilities to deactivate bot accounts.

Stay informed about security updates by monitoring Mattermost's official security updates page.

Useful 0 Not Useful 0