Hackit_Bharat

**Name of the Vulnerable Software and Affected Versions** Mattermost version 11.7.0 Mattermost versions prior to 10.11.17 **Description** Insufficient enforcement of bot-specific permission checks on the user active status endpoint allows a User Manager with user management write access, but lacking Integrations access, to deactivate bot accounts. This is possible through the 'PUT /api/v4/users/{id}/active' API endpoint using the `id` variable. **Recommendations** Update version 11.7.0 to a newer version that contains a fix. Update versions prior to 10.11.17 to version 10.11.17 or later. As a temporary workaround, restrict access to the 'PUT /api/v4/users/{id}/active' API endpoint for users without Integrations access.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.0 through 10.11.10 **Description** Mattermost versions 10.11.x up to and including 10.11.10 do not correctly validate permission requirements in the team member roles API endpoint. This allows team administrators to demote members to a guest role. The affected API endpoint is '/api/v1/teams/{team id}/members/{user id}/roles', where `team id` and `user id` are vulnerable parameters. **Recommendations** Update Mattermost to a version later than 10.11.10.

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.8 Mattermost versions 9.11.x through 9.11.17 Description: Mattermost fails to properly validate authorization for team scheme role modifications. This allows Team Admins to demote Team Members to Guests via the PUT `/api/v4/teams/team-id/members/user-id/schemeRoles` API endpoint. The vulnerable parameter is `user-id`. Recommendations: Mattermost versions 10.5.x through 10.5.8: Apply appropriate authorization checks to the `/api/v4/teams/team-id/members/user-id/schemeRoles` API endpoint to prevent unauthorized role modifications. Mattermost versions 9.11.x through 9.11.17: Apply appropriate authorization checks to the `/api/v4/teams/team-id/members/user-id/schemeRoles` API endpoint to prevent unauthorized role modifications.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.7.x through 10.7.0 Mattermost versions 10.5.x through 10.5.3 Mattermost versions 9.11.x through 9.11.12 **Description** The issue is related to the failure of Mattermost to properly enforce access control restrictions for System Manager roles. This allows authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console. **Recommendations** For Mattermost versions 10.7.x through 10.7.0, update to a version that properly enforces access control restrictions. For Mattermost versions 10.5.x through 10.5.3, update to a version that properly enforces access control restrictions. For Mattermost versions 9.11.x through 9.11.12, update to a version that properly enforces access control restrictions. As a temporary workaround, consider restricting access to team endpoints for System Manager roles until a patch is available.

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.5 Mattermost versions 9.11.x through 9.11.15 Mattermost versions 10.8.x through 10.8.0 Mattermost versions 10.7.x through 10.7.2 Mattermost versions 10.6.x through 10.6.5 Description: The issue arises from the failure to properly retrieve `requestorInfo` from the playbooks handler for guest users, allowing an attacker to access the playbook run. Recommendations: For Mattermost versions 10.5.x through 10.5.5, update to a version later than 10.5.5. For Mattermost versions 9.11.x through 9.11.15, update to a version later than 9.11.15. For Mattermost versions 10.8.x through 10.8.0, update to a version later than 10.8.0. For Mattermost versions 10.7.x through 10.7.2, update to a version later than 10.7.2. For Mattermost versions 10.6.x through 10.6.5, update to a version later than 10.6.5.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.5.x through 10.5.4 Mattermost versions 9.11.x through 9.11.13 **Description** The issue allows guest users to bypass permissions and view information about public teams they are not members of via a direct API call to "/api/v4/teams/{team id}". This is due to a failure to properly restrict API access to team information. **Recommendations** For Mattermost versions 10.5.x through 10.5.4, update to a version later than 10.5.4 to resolve the issue. For Mattermost versions 9.11.x through 9.11.13, update to a version later than 9.11.13 to resolve the issue. As a temporary workaround, consider restricting access to the "/api/v4/teams/{team id}" API endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.5.x through 10.5.1 Mattermost versions 10.4.x through 10.4.3 Mattermost versions 9.11.x through 9.11.9 **Description** The issue is related to the improper enforcement of the 'Allow users to view/update archived channels' System Console setting. This allows authenticated users to view members and member information of archived channels, even when this setting is disabled. **Recommendations** For versions 10.5.x through 10.5.1, update to a version that properly enforces the System Console setting. For versions 10.4.x through 10.4.3, update to a version that properly enforces the System Console setting. For versions 9.11.x through 9.11.9, update to a version that properly enforces the System Console setting. As a temporary workaround, consider restricting access to archived channels to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 9.11.x through 9.11.9 Mattermost versions 10.4.x through 10.4.3 Mattermost versions 10.5.x through 10.5.1 **Description** The issue arises from the failure to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels. This allows authenticated users to access such information when a channel is archived. **Recommendations** For versions 9.11.x through 9.11.9, update the configuration to properly enforce the "Allow Users to View Archived Channels" setting. For versions 10.4.x through 10.4.3, ensure that the channel metadata access is restricted based on the "Allow Users to View Archived Channels" configuration. For versions 10.5.x through 10.5.1, modify the channel metadata fetching process to account for the "Allow Users to View Archived Channels" setting, preventing unauthorized access to archived channel information.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 9.11.x through 9.11.8 Mattermost versions 10.3.x through 10.3.3 Mattermost versions 10.4.x through 10.4.2 **Description** The issue allows authenticated users to execute commands in archived channels, as the affected versions of Mattermost fail to restrict command execution in such channels. **Recommendations** For versions 9.11.x through 9.11.8, restrict access to archived channels to prevent command execution. For versions 10.3.x through 10.3.3, consider disabling command execution in archived channels until a fix is available. For versions 10.4.x through 10.4.2, avoid using archived channels for sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Mattermost (affected versions not specified) **Description** The issue arises when processing an email invite to a private channel on a team. Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nextcloud Server versions 24.0.x through 24.0.9 Nextcloud Server versions 25.0.x through 25.0.4 Nextcloud Enterprise Server versions 21.x through 21.0.9.9 Nextcloud Enterprise Server versions 22.x through 22.2.0.9 Nextcloud Enterprise Server versions 23.0.x through 23.0.12.4 Nextcloud Enterprise Server versions 24.0.x through 24.0.9 Nextcloud Enterprise Server versions 25.0.x through 25.0.3 **Description** The issue affects Nextcloud Server and Nextcloud Enterprise Server, where an attacker who gains access to an already logged-in user session can brute force the password on the confirmation endpoint. **Recommendations** For Nextcloud Server versions 24.0.x through 24.0.9, upgrade to version 24.0.10 or 25.0.5. For Nextcloud Server versions 25.0.x through 25.0.4, upgrade to version 25.0.5. For Nextcloud Enterprise Server versions 21.x through 21.0.9.9, upgrade to version 21.0.9.10. For Nextcloud Enterprise Server versions 22.x through 22.2.0.9, upgrade to version 22.2.0.10. For Nextcloud Enterprise Server versions 23.0.x through 23.0.12.4, upgrade to version 23.0.12.5. For Nextcloud Enterprise Server versions 24.0.x through 24.0.9, upgrade to version 24.0.10. For Nextcloud Enterprise Server versions 25.0.x through 25.0.3, upgrade to version 25.0.4.