CVE-2024-12247
📋 TL;DR
Mattermost fails to properly propagate permission scheme updates across cluster nodes, allowing users to retain old permissions even after administrators update permission schemes. This affects Mattermost versions 9.7.x up to 9.7.5, 9.8.x up to 9.8.2, and 9.9.x up to 9.9.2 in clustered deployments.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Users maintain elevated permissions they should have lost, potentially accessing sensitive channels, data, or administrative functions they're no longer authorized for.
Likely Case
Users retain outdated permissions causing minor privilege inconsistencies, potentially accessing channels or features they should no longer have access to.
If Mitigated
Limited impact with proper access controls and monitoring, though permission inconsistencies may persist until nodes sync.
🎯 Exploit Status
Exploitation occurs naturally when permission schemes are updated - affected users simply continue using old permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.7.6, 9.8.3, 9.9.3 or later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost installation and database. 2. Download the patched version from Mattermost downloads. 3. Stop Mattermost service. 4. Replace with patched version. 5. Restart Mattermost service. 6. Verify all cluster nodes are updated.
🔧 Temporary Workarounds
Manual permission re-sync
allManually remove and re-add users to channels/teams after permission changes to force permission updates.
Use Mattermost UI or API to remove affected users from channels/teams, then re-add them with correct permissions.
🧯 If You Can't Patch
- Monitor user activity logs for permission violations and audit channel access regularly.
- Implement additional access controls at network or application layer to restrict sensitive channel access.
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About or run: mattermost versionCheck Version:
mattermost versionVerify Fix Applied:
Update to patched version and test permission changes propagate across all cluster nodes.📡 Detection & Monitoring
Log Indicators:
- Users accessing channels they shouldn't have permissions for after permission scheme updates
- Permission mismatch warnings in cluster logs
Network Indicators:
- Unusual access patterns to restricted channels after permission changes
SIEM Query:
source="mattermost" AND ("permission denied" OR "access denied") AND user_changed_permissions=true