CVE-2024-5270
SAML to email switch possible when email signin is disabled
Summary
SAML to email switch possible when email signin is disabled
Original description
The description as published by the source.
Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a user requests to switch from SAML to Email. This allows the user to switch their authentication mail from SAML to email and possibly edit personal details that were otherwise non-editable and provided by the SAML provider.
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com