Mattermost and Mattermost Calls Cross-Site Request Forgery Vulnerability in Calls Widget

A cross-site request forgery (CSRF) vulnerability has been identified in Mattermost versions 11.0.x prior to 11.0.4, 10.12.x prior to 10.12.2, 10.11.x prior to 10.11.6, and Mattermost Calls versions prior to 1.10.0. The vulnerability arises from the lack of CSRF protection on the Calls widget page, allowing an authenticated attacker to initiate calls and inject messages into channels or direct messages through a malicious webpage or crafted link.

Impact

Exploitation of this vulnerability could lead to unauthorized initiation of calls and injection of messages into channels or direct messages, potentially disrupting communication or causing confusion among users.

Remediation

Users can upgrade to Mattermost versions 11.1.0, 10.12.3, or 10.11.7. For Mattermost Calls, version 1.10.0 or later should be installed.