System Admin Cannot Access Environment settings in System Console While System Manager Can
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.7epss 0.3%
exploitation probability
0.3%top 74% of all CVEs
observed exploitation
nono source reports it
Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which allows a System Manager to access `ExperimentSettings` when `RestrictSystemAdmin` is true via System Console.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Affected products
Mattermost · MattermostReferences
https://mattermost.com/security-updates