Mattermost Shared Channel Membership Sync Vulnerability Allowing Unauthorized Membership Removal

A vulnerability exists in Mattermost versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3. The issue arises because these versions do not properly verify whether a remote cluster has the right to access a channel before processing requests to remove membership during synchronization of shared channel memberships. This flaw enables a malicious remote cluster to remove any user from any channel, including private ones, by sending crafted membership synchronization messages targeting channels that the remote cluster is not authorized to access.

Impact

Exploitation of this vulnerability allows for unauthorized removal of users from channels, including private channels, potentially disrupting communication and collaboration.

Remediation

Users can upgrade to Mattermost versions 11.7.0, 11.6.0, or 10.11.15 to address this vulnerability.