Leandro Chaves

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.5 Mattermost versions 9.11.x through 9.11.15 Mattermost versions 10.8.x through 10.8.0 Mattermost versions 10.7.x through 10.7.2 Mattermost versions 10.6.x through 10.6.5 Description: The issue is related to the improper validation of channel membership when retrieving playbook run metadata. This allows authenticated users who are playbook members but not channel members to access sensitive information about linked private channels, including channel name, display name, and participant count, through the run metadata API endpoint. Recommendations: For Mattermost versions 10.5.x through 10.5.5, update to a version later than 10.5.5 to resolve the issue. For Mattermost versions 9.11.x through 9.11.15, update to a version later than 9.11.15 to resolve the issue. For Mattermost versions 10.8.x through 10.8.0, update to a version later than 10.8.0 to resolve the issue. For Mattermost versions 10.7.x through 10.7.2, update to a version later than 10.7.2 to resolve the issue. For Mattermost versions 10.6.x through 10.6.5, update to a version later than 10.6.5 to resolve the issue. As a temporary workaround, consider restricting access to the run metadata API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.x through 10.2 **Description** The issue arises from Mattermost's failure to accurately reflect missing settings, leading to confusion among administrators regarding a Calls security-sensitive configuration due to incorrect UI reporting. This confusion can stem from the UI not properly indicating the status of certain security settings, potentially causing administrators to misinterpret the security posture of their Calls configuration. **Recommendations** For Mattermost versions 10.x through 10.2, consider temporarily restricting access to the Calls security-sensitive configuration until a proper fix is available, to minimize the risk of exploitation due to the confusion caused by incorrect UI reporting.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 9.7.x through 9.7.5 Mattermost versions 9.8.x through 9.8.2 Mattermost versions 9.9.x through 9.9.2 **Description** The issue arises from the failure to properly propagate permission scheme updates across cluster nodes. This allows a user to retain old permissions even after the permission scheme has been updated. **Recommendations** For versions 9.7.x through 9.7.5, update to a version later than 9.7.5 to resolve the issue. For versions 9.8.x through 9.8.2, update to a version later than 9.8.2 to resolve the issue. For versions 9.9.x through 9.9.2, update to a version later than 9.9.2 to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Mattermost Server versions 8.1.x before 8.1.11 **Description** The issue is related to improper access control, allowing an attacker to continue participating in a call even after being removed from the channel. This occurs when the attacker is in a channel with an active call. **Recommendations** For versions 8.1.x before 8.1.11, update to version 8.1.11 or later to resolve the issue. As a temporary workaround, consider restricting access to channels with active calls to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions prior to v8.1.7 **Description** The issue arises when a user is demoted to a guest, and the system fails to update the permissions of the current session, allowing these freshly demoted guests to change group names. **Recommendations** For versions prior to v8.1.7, update to version v8.1.7 or later to resolve the issue. As a temporary workaround, consider restricting the ability of demoted guests to change group names until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mattermost (affected versions not specified) **Description** The issue arises from a failure to validate team membership when a user attempts to access a playbook. This allows a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This situation can occur if the user was once a member of the team, gained permissions to the playbook, and was then removed from the team. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.