CVE-2023-2786 MEDIUM

CVE-2023-2786: Channel commands execution doesn't properly verify permissions

Vendor Mattermost
Product Mattermost
Weakness CWE-862 · Missing authorization
Published June 16, 2023
Last update December 6, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing channel commands.

Key dates

02Disclosure timeline

June 16, 2023 CVE published
December 6, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-0719 Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_sort_order CVE-2025-42882 Missing Authorization check in SAP NetWeaver Application Server for ABAP CVE-2024-10586 Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation CVE-2026-2732 Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace CVE-2025-14913 Frontend Post Submission Manager Lite <= 1.2.6 - Incorrect Authorization to Unauthenticated Arbitrary Attachment Deletion