Authentication Bypass via Invitation Token in Mattermost

Executive Summary

Mattermost versions between 11.7.0 and 11.10.0 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens. This allows an authenticated attacker to join a team or access private channels using a forwarded or leaked invitation link.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to private channels or teams by exploiting a leaked invitation link. This could lead to data exposure, unauthorized actions, or further compromise of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Compliance may be compromised if unauthorized access results in data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update Mattermost to a version that is not affected by this vulnerability. Specifically, upgrade to versions 11.10.1 or later, 11.7.10 or later, 11.9.2 or later, or 11.8.6 or later to address the issue.

Useful 0 Not Useful 0