CVE-2024-23488: Mattermost fails to properly restrict the access of files attached to posts

February 29, 2024

Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.

References

github.com/advisories/GHSA-xgxj-j98c-59rv
github.com/mattermost/mattermost
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2024-23488

Detect and mitigate CVE-2024-23488 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →