GCVE - cpe:2.3:a:mattermost:mattermost:9.9.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mattermost:mattermost:9.9.0:*:*:*:*:*:*:*

part: a version: 9.9.0 update: *

Vendor	Mattermost (`ed0788ef-af60-58f1-b6aa-68289d9946dc`)
Product	Mattermost (`fd9a4a2e-f26d-5cef-a4c3-f85b0b13d8ea`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-39832`	vulnerable	2026-06-03 14:56:22.547325	Permanently local data deletion by malicious remote MEDIUM (6.8) Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly safeguard an error handling which allows a malicious remote to permanently delete local data by abusing dangerous error handling, when share channels were enabled. Published: 2024-08-01T14:05:04.850Z Updated: 2024-08-07T14:09:31.969Z Open on db.gcve.eu Reference links https://mattermost.com/security-updates	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-39777`	vulnerable	2026-06-03 14:56:22.396582	Malicious remote can invite itself to an arbitrary local channel HIGH (8.7) Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin. Published: 2024-08-01T14:05:03.701Z Updated: 2024-08-01T16:07:03.592Z Open on db.gcve.eu Reference links https://mattermost.com/security-updates	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-39274`	vulnerable	2026-06-03 14:56:20.422360	Malicious remote can add users to arbitrary teams and channels HIGH (8.7) Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled, which allows a malicious remote to add users to arbitrary teams and channels Published: 2024-08-01T14:05:02.518Z Updated: 2024-08-02T15:10:58.701Z Open on db.gcve.eu Reference links https://mattermost.com/security-updates	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-36492`	vulnerable	2026-06-03 14:56:04.683928	Existing local user overwritten by malicious remote HIGH (7.4) Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in shared channels. which allows a malicious remote to overwrite an existing local user. Published: 2024-08-01T14:05:01.393Z Updated: 2024-08-05T16:57:11.289Z Open on db.gcve.eu Reference links https://mattermost.com/security-updates	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-29977`	vulnerable	2026-06-03 14:55:27.793819	Malicious remote can create arbitrary reactions on arbitrary posts LOW (2.7) Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remote to create arbitrary reactions on arbitrary posts Published: 2024-08-01T14:05:00.340Z Updated: 2024-08-01T14:35:07.529Z Open on db.gcve.eu Reference links https://mattermost.com/security-updates	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.