Mattermost Link Metadata Vulnerability Allowing Unauthorized Access to Posts and Link Preview Poisoning

A vulnerability exists in Mattermost versions 10.8.x through 10.8.3, 10.5.x through 10.5.8, 9.11.x through 9.11.17, 10.10.x through 10.10.1, and 10.9.x through 10.9.3. The issue arises from improper validation of cache keys for link metadata, enabling authenticated users to access unauthorized posts and manipulate link previews through hash collision attacks on FNV-1 hashing.

Impact

Exploitation of this vulnerability allows for unauthorized access to posts and the ability to poison link previews, potentially leading to the dissemination of misleading information or the manipulation of content visibility.

Remediation

Users can upgrade to Mattermost versions 10.11.0, 10.5.10, 9.11.18, or 10.10.2 to address this vulnerability.