CVE-2024-4195

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Apr 26, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-419507.5Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. HCVE-2024-419514.4Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games. The issue is that the mCVE-2024-419525.3Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which CVE-2024-419536.1Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamicCVE-2024-419547.8FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/optCVE-2024-419555.4Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redireCVE-2024-419568.1Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repositorCVE-2024-419575.3Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the correspondingCVE-2024-419587.2mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authenticCVE-2024-419596.1mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload intCVE-2024-41969.8An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a speciaCVE-2024-419604.8mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload int
CVE-2024-4195: Low severity, CVSS 2.7 | Vulnix