deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-mqp8-pgg5-7x7m
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 10.5.0, < 10.5.12
Patched in: 10.5.12

Summary: Mattermost allows system administrators to access password hashes and MFA secrets

Details:
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint
GitHub Security Advisory: GHSA-mqp8-pgg5-7x7m
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 10.11.0, < 10.11.4
Patched in: 10.11.4

Summary: Mattermost allows system administrators to access password hashes and MFA secrets

Details:
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint
GitHub Security Advisory: GHSA-ff85-qw3h-g9vp
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: < 8.0.0[PII_REDACTED]2932-a41db04d2746
Patched in: 8.0.0[PII_REDACTED]2932-a41db04d2746

Summary: Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL

Details:
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.
GitHub Security Advisory: GHSA-ff85-qw3h-g9vp
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 10.12.0, < 10.12.1
Patched in: 10.12.1

Summary: Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL

Details:
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.
GitHub Security Advisory: GHSA-ff85-qw3h-g9vp
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 10.5.0, < 10.5.12
Patched in: 10.5.12

Summary: Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL

Details:
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.
GitHub Security Advisory: GHSA-ff85-qw3h-g9vp
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 10.11.0, < 10.11.4
Patched in: 10.11.4

Summary: Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL

Details:
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.
GitHub Security Advisory: GHSA-x3hx-ch7p-8xgg
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]5020-c8d66301415d
Patched in: 8.0.0[PII_REDACTED]5020-c8d66301415d

Summary: Mattermost allows regular users to access archived channel content and files

Details:
Mattermost versions < 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads
GitHub Security Advisory: GHSA-x3hx-ch7p-8xgg
Package: github.com/mattermost/mattermost-server (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 11.0.0-alpha.1
Patched in: 11.0.0-alpha.1

Summary: Mattermost allows regular users to access archived channel content and files

Details:
Mattermost versions < 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads
GitHub Security Advisory: GHSA-xpg8-8xpv-948p
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: < 8.0.0[PII_REDACTED]3506-7d8b7b5e4a60
Patched in: 8.0.0[PII_REDACTED]3506-7d8b7b5e4a60

Summary: Mattermost does not enforce MFA on WebSocket connections

Details:
Mattermost versions < 11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events.
GitHub Security Advisory: GHSA-xpg8-8xpv-948p
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: < 11.1.0
Patched in: 11.1.0

Summary: Mattermost does not enforce MFA on WebSocket connections

Details:
Mattermost versions < 11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events.
GitHub Security Advisory: GHSA-j6gg-r5jc-47cm
Package: github.com/mattermost/mattermost-server/v6 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 5.3.2-0[PII_REDACTED]5020-c8d66301415d
Patched in: 5.3.2-0[PII_REDACTED]5020-c8d66301415d

Summary: Mattermost fails to properly restrict access to archived channel search API

Details:
Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
GitHub Security Advisory: GHSA-j6gg-r5jc-47cm
Package: github.com/mattermost/mattermost-server/v5 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 5.3.2-0[PII_REDACTED]5020-c8d66301415d
Patched in: 5.3.2-0[PII_REDACTED]5020-c8d66301415d

Summary: Mattermost fails to properly restrict access to archived channel search API

Details:
Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
GitHub Security Advisory: GHSA-j6gg-r5jc-47cm
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 5.3.2-0[PII_REDACTED]5020-c8d66301415d
Patched in: 5.3.2-0[PII_REDACTED]5020-c8d66301415d

Summary: Mattermost fails to properly restrict access to archived channel search API

Details:
Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
GitHub Security Advisory: GHSA-j6gg-r5jc-47cm
Package: github.com/mattermost/mattermost (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 5.3.2-0[PII_REDACTED]5020-c8d66301415d
Patched in: 5.3.2-0[PII_REDACTED]5020-c8d66301415d

Summary: Mattermost fails to properly restrict access to archived channel search API

Details:
Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
GitHub Security Advisory: GHSA-j6gg-r5jc-47cm
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]5020-c8d66301415d
Patched in: 8.0.0[PII_REDACTED]5020-c8d66301415d

Summary: Mattermost fails to properly restrict access to archived channel search API

Details:
Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
GitHub Security Advisory: GHSA-9mj6-hxhv-w67j
Package: github.com/dvsekhvalnov/jose2go (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.7.0
Patched in: 1.7.0

Summary: jose2go is vulnerable to a JWT bomb attack through its decode function

Details:
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high compression ratio.
GitHub Security Advisory: GHSA-mj6p-p843-x5wc
Package: github.com/rhobs/observability-operator (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: < 1.3.0
Patched in: 1.3.0

Summary: Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack

Details:
A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.
GitHub Security Advisory: GHSA-j4g7-v4m4-77px
Package: github.com/zitadel/zitadel (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 1.80.0-v2.20.0[PII_REDACTED]0621-5b3946b67ef6, < 1.80.0-v2.20.0[PII_REDACTED]4840-33c51deb2040
Patched in: 1.80.0-v2.20.0[PII_REDACTED]4840-33c51deb2040

Summary: ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP

Details:
### Summary

A vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication.

### Impact

This vulnerability stems from the platform's failure to correctly check or enforce an organization's specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process.

This allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker's external identity to an existing internal user account.

This may result in a full Account Takeover, bypassing the organization's mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process.

### Affected Versions

Systems running one of the following versions are affected:
- **v4.x**: `4.0.0-rc.1` through `4.6.5`
- **v3.x**: `3.0.0-rc.1` through `3.4.3`
- **v2.x**: `2.50.0` through `2.71.18`

### Patches

The vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the organization's login policy before auto-linking an external user.

- v4.x: Upgrade to version [4.6.6](https://github.com/zitadel/zitadel/releases/tag/v4.6.6) or later.
- v3.x: Update to version [3.4.4](https://github.com/zitadel/zitadel/releases/tag/v3.4.4) or later.
- v2.x: Update to version [2.71.19](https://github.com/zitadel/zitadel/releases/tag/v2.71.19) or later.

### Workarounds

Upgrading to a patched version is the recommended solution.

### Questions

If you have any questions or comments about this advisory, please email Zitadel at [security@zitadel.com](mailto:security@zitadel.com)

### Credits

Thanks to Jan Kühnlein - kultify for finding and reporting the vulnerability.
GitHub Security Advisory: GHSA-j4g7-v4m4-77px
Package: github.com/zitadel/zitadel (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 2.50.0, < 2.71.19
Patched in: 2.71.19

Summary: ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP

Details:
### Summary

A vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication.

### Impact

This vulnerability stems from the platform's failure to correctly check or enforce an organization's specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process.

This allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker's external identity to an existing internal user account.

This may result in a full Account Takeover, bypassing the organization's mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process.

### Affected Versions

Systems running one of the following versions are affected:
- **v4.x**: `4.0.0-rc.1` through `4.6.5`
- **v3.x**: `3.0.0-rc.1` through `3.4.3`
- **v2.x**: `2.50.0` through `2.71.18`

### Patches

The vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the organization's login policy before auto-linking an external user.

- v4.x: Upgrade to version [4.6.6](https://github.com/zitadel/zitadel/releases/tag/v4.6.6) or later.
- v3.x: Update to version [3.4.4](https://github.com/zitadel/zitadel/releases/tag/v3.4.4) or later.
- v2.x: Update to version [2.71.19](https://github.com/zitadel/zitadel/releases/tag/v2.71.19) or later.

### Workarounds

Upgrading to a patched version is the recommended solution.

### Questions

If you have any questions or comments about this advisory, please email Zitadel at [security@zitadel.com](mailto:security@zitadel.com)

### Credits

Thanks to Jan Kühnlein - kultify for finding and reporting the vulnerability.
GitHub Security Advisory: GHSA-j4g7-v4m4-77px
Package: github.com/zitadel/zitadel (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 3.0.0-rc.1, < 3.4.4
Patched in: 3.4.4

Summary: ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP

Details:
### Summary

A vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication.

### Impact

This vulnerability stems from the platform's failure to correctly check or enforce an organization's specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process.

This allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker's external identity to an existing internal user account.

This may result in a full Account Takeover, bypassing the organization's mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process.

### Affected Versions

Systems running one of the following versions are affected:
- **v4.x**: `4.0.0-rc.1` through `4.6.5`
- **v3.x**: `3.0.0-rc.1` through `3.4.3`
- **v2.x**: `2.50.0` through `2.71.18`

### Patches

The vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the organization's login policy before auto-linking an external user.

- v4.x: Upgrade to version [4.6.6](https://github.com/zitadel/zitadel/releases/tag/v4.6.6) or later.
- v3.x: Update to version [3.4.4](https://github.com/zitadel/zitadel/releases/tag/v3.4.4) or later.
- v2.x: Update to version [2.71.19](https://github.com/zitadel/zitadel/releases/tag/v2.71.19) or later.

### Workarounds

Upgrading to a patched version is the recommended solution.

### Questions

If you have any questions or comments about this advisory, please email Zitadel at [security@zitadel.com](mailto:security@zitadel.com)

### Credits

Thanks to Jan Kühnlein - kultify for finding and reporting the vulnerability.
GitHub Security Advisory: GHSA-j4g7-v4m4-77px
Package: github.com/zitadel/zitadel (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 4.0.0-rc.1, < 4.6.6
Patched in: 4.6.6

Summary: ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP

Details:
### Summary

A vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication.

### Impact

This vulnerability stems from the platform's failure to correctly check or enforce an organization's specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process.

This allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker's external identity to an existing internal user account.

This may result in a full Account Takeover, bypassing the organization's mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process.

### Affected Versions

Systems running one of the following versions are affected:
- **v4.x**: `4.0.0-rc.1` through `4.6.5`
- **v3.x**: `3.0.0-rc.1` through `3.4.3`
- **v2.x**: `2.50.0` through `2.71.18`

### Patches

The vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the organization's login policy before auto-linking an external user.

- v4.x: Upgrade to version [4.6.6](https://github.com/zitadel/zitadel/releases/tag/v4.6.6) or later.
- v3.x: Update to version [3.4.4](https://github.com/zitadel/zitadel/releases/tag/v3.4.4) or later.
- v2.x: Update to version [2.71.19](https://github.com/zitadel/zitadel/releases/tag/v2.71.19) or later.

### Workarounds

Upgrading to a patched version is the recommended solution.

### Questions

If you have any questions or comments about this advisory, please email Zitadel at [security@zitadel.com](mailto:security@zitadel.com)

### Credits

Thanks to Jan Kühnlein - kultify for finding and reporting the vulnerability.
GitHub Security Advisory: GHSA-mqcj-8c2g-h97q
Package: github.com/mattermost/mattermost-server/v6 (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 5.3.2-0[PII_REDACTED]0616-ba86dfc5876b
Patched in: 5.3.2-0[PII_REDACTED]0616-ba86dfc5876b

Summary: Mattermost Incorrect Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.
GitHub Security Advisory: GHSA-mqcj-8c2g-h97q
Package: github.com/mattermost/mattermost-server/v5 (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 5.3.2-0[PII_REDACTED]0616-ba86dfc5876b
Patched in: 5.3.2-0[PII_REDACTED]0616-ba86dfc5876b

Summary: Mattermost Incorrect Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.
GitHub Security Advisory: GHSA-mqcj-8c2g-h97q
Package: github.com/mattermost/mattermost-server (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 5.3.2-0[PII_REDACTED]0616-ba86dfc5876b
Patched in: 5.3.2-0[PII_REDACTED]0616-ba86dfc5876b

Summary: Mattermost Incorrect Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.
GitHub Security Advisory: GHSA-mqcj-8c2g-h97q
Package: github.com/mattermost/mattermost (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 5.3.2-0[PII_REDACTED]0616-ba86dfc5876b
Patched in: 5.3.2-0[PII_REDACTED]0616-ba86dfc5876b

Summary: Mattermost Incorrect Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.
GitHub Security Advisory: GHSA-mqcj-8c2g-h97q
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]0616-ba86dfc5876b
Patched in: 8.0.0[PII_REDACTED]0616-ba86dfc5876b

Summary: Mattermost Incorrect Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.