Moderate severityNVD Advisory· Published Aug 22, 2024· Updated Aug 22, 2024
Munged email address used for password resets and notifications
CVE-2024-39836
Description
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/mattermost/mattermost/server/v8Go | >= 9.9.0, < 9.9.2 | 9.9.2 |
github.com/mattermost/mattermost/server/v8Go | >= 9.5.0, < 9.5.8 | 9.5.8 |
github.com/mattermost/mattermost/server/v8Go | >= 9.10.0, < 9.10.1 | 9.10.1 |
github.com/mattermost/mattermost/server/v8Go | >= 9.8.0, < 9.8.3 | 9.8.3 |
Affected products
1- Range: 9.9.0
Patches
443355fe32a95cd60532e9a417bbf7ec1304823993132c67bVulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- github.com/advisories/GHSA-c6vp-jjgv-38wjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-39836ghsaADVISORY
- mattermost.com/security-updatesghsaWEB
News mentions
0No linked articles in our index yet.