CVE-2024-8071: 
Mattermost vulnerability analysis and mitigation

A privilege escalation vulnerability (CVE-2024-8071) affects Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, and 9.8.x <= 9.8.2. The vulnerability allows a System Role with edit access to the permissions section of system console to update their role to include the manage_system permission, effectively becoming a System Admin (NVD).

The vulnerability is classified as an improper access control issue (CWE-284). It has received two different CVSS v3.1 scores: a High severity score of 7.2 from NIST (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and a Medium severity score of 4.7 from Mattermost, Inc. (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) (NVD).

The vulnerability allows users with system console access to elevate their privileges to system administrator level, potentially gaining full control over the Mattermost instance. This could lead to unauthorized access to sensitive information and system configuration changes (NVD).

Users should upgrade to the following fixed versions: 9.5.8 for 9.5.x series, 9.8.3 for 9.8.x series, 9.9.2 for 9.9.x series, or 9.10.1 for 9.10.x series (NVD).