CVE-2023-4478
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Mattermost fails to restrict which parameters' values it takes from the request during signup, allowing an attacker to register users as inactive. This blocks them from later accessing Mattermost without the system admin activating their accounts.
Risk Assessment
An attacker can block access to the platform for new users, potentially leading to availability issues and account management problems within the organization.
Recommendation
It is recommended to update Mattermost to the latest version to patch this vulnerability and review user registration procedures.
Original NVD description (English source)
Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.