CVE-2018-21251

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-212524.3An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass aCVE-2018-212534.3An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite CVE-2018-212544.3An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creationCVE-2018-212554.3An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel.CVE-2018-212564.3An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for group-message channCVE-2018-212575.3An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel hCVE-2018-212587.5An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash commanCVE-2018-212595.3An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service (application CVE-2018-212602.7An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-manCVE-2018-212614.3An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, whicCVE-2018-212627.5An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid CVE-2018-212638.8An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account vi
CVE-2018-21251: Critical severity, CVSS 9.8 | Vulnix