{"id":"CVE-2023-50333","published":"2024-01-02T09:53:01Z","modified":"2025-06-17T13:35:30Z","title":"Lack of restriction to manage group names for freshly demoted guests","vendor":"Mattermost","product":"Mattermost","tier":"tail","description":{"text":"Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.\n\n","provenance":"source","from":"CVE.org"},"cvss":{"score":3.7,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0032,"percentile":0.25041,"provenance":"source"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://mattermost.com/security-updates","tags":[]}],"priority":{"score":7.6,"factors":[{"name":"EPSS percentile","points":5.01},{"name":"CVSS severity","points":2.59}]},"vendorSlug":"mattermost","affectedVersions":[{"vendor":"Mattermost","product":"Mattermost","versions":["<= 9.2.2","<= 8.1.6"]}],"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","vulnerableRanges":["<8.1.7","all versions"],"patched":["8.1.7"],"from":["GHSA-9w97-9rqx-8v4j","GO-2024-2444"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2444"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v5","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2444"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v6","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2444"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0319","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mattermost-cve-2023-50333","children":[{"from":"CVE-2023-50333","to":"CVE-2024-4183","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/channels/app/platform/session.go"],"commits":["https://github.com/mattermost/mattermost/commit/61dd452fb2fcd3ac6f7b2e050f7f0a93a92d95fc","https://github.com/mattermost/mattermost/commit/86920d641760552c5aafa5e1d14c93bd30039bc4","https://github.com/mattermost/mattermost/commit/9d81eee979aee93374bff8ba6714d805e12ffb03"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-47865","published":"2023-11-27","fixed":"8.1.4","kev":false},{"cve":"CVE-2023-6459","published":"2023-12-06","fixed":"8.1.5","kev":false,"link":{"from":"CVE-2023-6459","to":"CVE-2023-50333","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost/server/v8","fromFixed":"8.1.5","toFixed":"8.1.7","daysApart":27}]}},{"cve":"CVE-2023-48732","published":"2024-01-02","fixed":"8.1.7","kev":false},{"cve":"CVE-2023-50333","published":"2024-01-02","fixed":"8.1.7","kev":false},{"cve":"CVE-2023-7113","published":"2023-12-29","fixed":"8.1.7","kev":false},{"cve":"CVE-2024-21848","published":"2024-04-05","fixed":"8.1.11","kev":false},{"cve":"CVE-2023-5967","published":"2023-11-06","fixed":"9.0.1","kev":false}],"package":"Go:github.com/mattermost/mattermost/server/v8"}}