CVE-2025-24866
Unauthorized Access to User Activity Logs API by delegated granular administration roles
Résumé
Unauthorized Access to User Activity Logs API by delegated granular administration roles
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Go
github.com/mattermost/mattermost/server/v8
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.0.0-20250204211032-f52e08754c49"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web mattermost.com
- web pkg.go.dev