CVE-2024-50052

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Oct 29, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-500535.4Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerablCVE-2024-500547.5The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path tCVE-2024-500557.8In the Linux kernel, the following vulnerability has been resolved: driver core: bus: Fix double free in driver API bus_register() For busCVE-2024-500565.5In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c Fix potential CVE-2024-500573.3In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: Free IRQ only if it was requested before In polling CVE-2024-500585.5In the Linux kernel, the following vulnerability has been resolved: serial: protect uart_port_dtr_rts() in uart_shutdown() too Commit af22CVE-2024-500597.0In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntCVE-2024-50065.4The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter CVE-2024-500605.5In the Linux kernel, the following vulnerability has been resolved: io_uring: check if we need to reschedule during overflow flush In termCVE-2024-500617.0In the Linux kernel, the following vulnerability has been resolved: i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master CVE-2024-500625.5In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Avoid null pointer deref during path establishment For CVE-2024-500637.8In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bpf p
CVE-2024-50052: Medium severity, CVSS 4.3 | Vulnix