Vulnerability Database

315,050

Total vulnerabilities in the database

CVE-2024-42497

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.

Published: Aug 22, 2024
Updated: Nov 16, 2025
CVE: CVE-2024-42497
GHSA: GHSA-fxq9-6946-34q7
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

CWEs:

CWE-284

OWASP TOP 10:

A5 - Broken Access Control

Affected Software
References

Software	From	Fixed in
github.com/mattermost/mattermost/server/v8	9.5.0	9.5.8
github.com/mattermost/mattermost/server/v8	9.10.0	9.10.1
github.com/mattermost/mattermost/server/v8	9.9.0	9.9.2
github.com/mattermost/mattermost/server/v8	9.8.0	9.8.3
mattermost / mattermost_server	9.8.0	9.8.3
mattermost / mattermost_server	9.5.0	9.5.8
mattermost / mattermost_server	9.9.0	9.9.2
mattermost / mattermost_server	9.10.0	9.10.0.x

https://mattermost.com/security-updates

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo