PT-2020-8430 · Mattermost · Mattermost Server

CVE-2017-18884

·

Published

2020-06-19

·

Updated

2026-07-30

CVSS v4.0

9.3

Critical

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2
Description: An issue was discovered in Mattermost Server that allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
Recommendations: For Mattermost Server versions prior to 4.3.0, update to version 4.3.0 or later. For Mattermost Server version 4.2.1, update to version 4.3.0 or later. For Mattermost Server version 4.1.2, update to version 4.3.0 or later. As a temporary workaround, consider restricting the use of registered OAuth applications with personal access tokens until a patch is available.

Fix

DoS

Improper Privilege Management

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-269CWE-863

Related Identifiers

CVE-2017-18884
GHSA-876J-JFQF-M7J7
GO-2025-4197
OPENSUSE-SU-2026:21483-1
SUSE-SU-2025:4395-1

Affected Products

Mattermost Server