CVE-2024-34029

Summary

CVE-2024-34029 is a vulnerability affecting Mattermost versions 9.5.x up to 9.5.3, 9.7.x up to 9.7.1, and 8.1.x up to 8.1.12. The issue lies in the /api/v4/groups/<group-id>/channels/<channel-id>/link endpoint where authorization checks are insufficient. This flaw enables users to access the members of an Active Directory/Lightweight Directory Access Protocol (AD/LDAP) group linked to a team, even if they have no access to the team itself. The vulnerability could potentially lead to unauthorized access to sensitive information.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.