Skip to content
CVE Tracker
Back

CVE-2024-9155

Insufficient Authorization On Unlinked Channel Files

Medium4.3EPSS 0.26%
Published
Updated
Reserved
Assigned by
Mattermost

Description

Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of.

Scores

CVSS scores of CVE-2024-9155, by who scored it
Scored byCVSSScoreVector
MattermostCNA (assigner)3.1Medium4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Analyzed3.1Medium4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS (exploitation in 30 days)
0.26% · top 82% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

Affected products

  • Mattermost · Mattermost

    • affected 9.10.0 – ≤ 9.10.1
    • affected 9.9.0 – ≤ 9.9.2
    • affected 9.5.0 – ≤ 9.5.8
    • unaffected 9.11.0
    • unaffected 9.10.2
    • unaffected 9.9.3
    • unaffected 9.5.9

What to do

Solution: Update Mattermost to versions 9.11.0, 9.10.2, 9.9.3, 9.5.9 or higher.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .