Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL.

Affected Packages

Go github.com/mattermost/mattermost/server/v8

Affected versions: 9.5.0 (fixed in 9.5.8)

Go github.com/mattermost/mattermost/server/v8

Affected versions: 9.10.0 (fixed in 9.10.1)

Related CVEs

CVE-2024-40884

Key Information

GHSA ID

GHSA-3j95-8g47-fpwh

Published

August 22, 2024 6:31 PM

Last Modified

November 18, 2024 4:27 PM

CVSS Score

5.0 /10

Primary Ecosystem

Primary Package

github.com/mattermost/mattermost/server/v8

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 2, 2025 6:46 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.