CVE-2023-1774 MEDIUM

CVE-2023-1774: Unauthorized email invite to a private channel

Vendor Mattermost
Product Mattermost
Weakness CWE-862 · Missing authorization
Published March 31, 2023
Last update December 6, 2024
View on NVD All CVEs

CVSS base score

4.2/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.

Key dates

02Disclosure timeline

March 31, 2023 CVE published
December 6, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-25035 WordPress Quick Contact Form plugin <= 8.0.3.1 - Broken Access Control vulnerability CVE-2025-42984 Missing Authorization check in SAP S/4HANA (Manage Central Purchase Contract application) CVE-2023-41671 WordPress Abandoned Cart Lite for WooCommerce plugin <= 5.16.1 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-32451 WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability CVE-2025-43000 Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW)