CVE-2024-39836: Munged email address used for password resets and notifications

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-22 · updated 2026-06-17
Weakness: CWE-693

Description

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.

Affected products

Mattermost App Framework: from 9.5.0 before 9.5.8; from 9.8.0 before 9.8.3; from 9.9.0 before 9.9.2; from 9.10.0 before 9.10.1 — fixed in 9.10.1, 9.5.8, 9.8.3, 9.9.2

How to fix

Upgrade to a fixed version: Mattermost App Framework 9.10.1, 9.5.8, 9.8.3, 9.9.2. Check the vendor advisory for mitigations.

References

https://mattermost.com/security-updates

Get alerted when CVE-2024-39836 or the next vulnerability affects your stack