VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 3, 2024· Updated Aug 2, 2024

Creating posts with user-defined IDs permitted in CreatePost API

CVE-2024-39361

Description

Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an attacker to specify both a remoteId and the post ID, resulting in creating a post with a user-defined post ID. This can cause some broken functionality in the channel or thread with user-defined posts

Affected products

1

Patches

4
01723a784c5e
https://github.com/mattermost/mattermost-servervia osv
327e1a1dad17
https://github.com/mattermost/mattermost-servervia osv
e5addb495b22
https://github.com/mattermost/mattermost-servervia osv
6eb3d42f52be
https://github.com/mattermost/mattermost-servervia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

0

No linked articles in our index yet.