PT-2026-91236
CVE-2026-82920
·
تاريخ النشر
2026-09-14
·
تاريخ التحديث
2026-10-07
الوصف من
CVSS 3.1
5.5
متوسطةالمقاييسAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Mattermost version 11.9.0
Mattermost version 11.8.4
Mattermost version 11.7.7
Description
Authorization boundaries are not properly enforced on the access control policy update endpoint. This allows a channel or team administrator to detach a system-assigned ABAC (Attribute-Based Access Control) parent policy by sending a crafted PUT request to the '/api/v4/access control policies' endpoint with an empty
imports list.Recommendations
Update Mattermost version 11.9.0 to a newer version.
Update Mattermost version 11.8.4 to a newer version.
Update Mattermost version 11.7.7 to a newer version.
Restrict access to the '/api/v4/access control policies' endpoint to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾