CVE-2024-1888: Existing server guests invited to the team by members without "invite_guest" permission

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-29 · updated 2026-06-17
Weakness: CWE-284

Description

Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another team of the server

Affected products

Mattermost: before 8.1.9; from 9.2.0 before 9.2.5; from 9.3.0 before 9.3.1; from 9.4.0 before 9.4.2 — fixed in 8.1.9, 9.2.5, 9.3.1, 9.4.2

How to fix

Upgrade to a fixed version: Mattermost 8.1.9, 9.2.5, 9.3.1, 9.4.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1888 or the next vulnerability affects your stack