CVE-2023-4478

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	<= 7.8.8; <= 7.10.4; 8.0.0

References

https://mattermost.com/security-updatesVendor Advisory
https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Aug 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-44795.4Stored XSS Vulnerability in M-Files Web versions before 23.8 allows attacker to execute script on users browser via stored HTML document wit CVE-2023-447949.8An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.CVE-2023-447965.4Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a cra CVE-2023-44805.5Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted r CVE-2023-448079.8D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the cancelPing function.CVE-2023-448089.8D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function.CVE-2023-448099.8D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.CVE-2023-44817.5An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an CVE-2023-448118.8Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive CVE-2023-448126.1Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to th CVE-2023-448136.1Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to th CVE-2023-44825.4The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and inclu