Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization

Also known as GHSA-hgrp-fgm8-56g8, GO-2025-4075

Published 6 y ago 2020-06-19 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.3

v3.1 · NVD

CISA KEV

not known exploited

EPSS

0.6%

percentile 47%

Public exploits

none known

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.

Exploit prediction (EPSS)

0.57% probability of exploitation in the next 30 days, higher than 47% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	4.3	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`
NVD	2.0	3.5	`AV:N/AC:M/Au:S/C:N/I:P/A:N`
GitHub	3.1	4.3	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/mattermost/mattermost-server`	<4.3.3 >=4.4.0-rc1, <4.4.3 <4.3.3+incompatible >=4.4.0-rc1+incompatible, <4.4.3+incompatible	4.3.3 4.4.3 4.3.3+incompatible 4.4.3+incompatible

Classification

Weakness

CWE-732 Incorrect Permission Assignment for Critical Resource
CWE-862 Missing Authorization

References

mattermost.com /security-updates/ · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-18872 · advisory
github.com /mattermost/mattermost/commit/8f6bb1570dd234c63de5241eff9fbb268aad358c · web
github.com /mattermost/mattermost · package
mattermost.com /security-updates · web
github.com /mattermost/mattermost/commit/753386c2b2b06233d8bd977e3db29a4fe18098cb · web
github.com /advisories/GHSA-hgrp-fgm8-56g8 · advisory

Sources

CVE List: CVE-2017-18872
GitHub Advisory: GHSA-hgrp-fgm8-56g8
NVD: CVE-2017-18872
OSV: GO-2025-4075

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.