Mattermost · Mattermost Server · CVE-2024-29221
**Name of the Vulnerable Software and Affected Versions**
Mattermost Server versions 8.1.x through 8.1.10
Mattermost Server versions 9.3.x through 9.3.2
Mattermost Server versions 9.4.x through 9.4.3
Mattermost Server versions 9.5.x through 9.5.1
**Description**
The issue is related to improper access control in the Mattermost Server, specifically in the "/api/v4/users/me/teams" endpoint, allowing a team admin to get the invite ID of their team and invite users even if the "Add Members" permission was explicitly removed from team admins.
**Recommendations**
For Mattermost Server versions 8.1.x through 8.1.10, update to version 8.1.11 or later.
For Mattermost Server versions 9.3.x through 9.3.2, update to version 9.3.3 or later.
For Mattermost Server versions 9.4.x through 9.4.3, update to version 9.4.4 or later.
For Mattermost Server versions 9.5.x through 9.5.1, update to version 9.5.2 or later.