CVE-2023-47865: 
Mattermost vulnerability analysis and mitigation

Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. The vulnerability was discovered in Mattermost versions up to 7.8.12 and versions 8.0.0 through 8.1.3, and was assigned CVE-2023-47865. The issue was disclosed on November 27, 2023 (NVD).

The vulnerability allows a member to override the username and profile picture when making a post even if the Hardened Mode setting was enabled, provided that settings allowed integrations to override the username and profile picture when posting. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, and low privileges required (NVD).

The vulnerability affects the integrity of the system by allowing unauthorized modification of usernames and profile pictures, potentially leading to impersonation or confusion in communication channels. The CVSS scoring indicates low impact on integrity with no direct impact on confidentiality or availability (NVD).

The vulnerability has been fixed in subsequent versions of Mattermost. Organizations should upgrade to the latest version of Mattermost to address this security issue (Vendor Advisory).