Skip to content
Fencer Intel
medium 4.3

CVE-2017-18872 json

Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization

published 2020-06-19 6 y ago modified 2026-06-17 4 mo ago also GHSA-hgrp-fgm8-56g8 , GO-2025-4075 , EUVD-2017-9962

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.

Patch / fix

  • go github.com/mattermost/mattermost-server 4.3.3, 4.3.3+incompatible, 4.4.3, 4.4.3+incompatible
  • mattermost mattermost_server 4.3.3, 4.4.3
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20251105T184115-1.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2025:15710-1

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N
GitHub 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/mattermost/mattermost-server
<4.3.3
>=4.4.0-rc1, <4.4.3
<4.3.3+incompatible
>=4.4.0-rc1+incompatible, <4.4.3+incompatible
4.3.3
4.4.3
4.3.3+incompatible
4.4.3+incompatible

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource
  • CWE-862 Missing Authorization

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.