CVE-2025-24866
Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint
概要
Mattermost Fails to Enforce Proper Access Controls on /api/v4/audits Endpoint
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Go
github.com/mattermost/mattermost/server/v8
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.0.0-20250204211032-f52e08754c49"}]}]
参照URL
- advisory nvd.nist.gov
- package github.com
- web mattermost.com
- web pkg.go.dev