CVE-2022-1385: Improper Control of a Resource Through its Lifetime in Mattermost
Summary
CVE-2022-1385: Improper Control of a Resource Through its Lifetime in Mattermost. Affects github.com/mattermost/mattermost-server/v6 versions < 6.5.0. Fixed in 6.5.0. How to fix ↓
Also tracked for
- github.com/mattermost/mattermost-server · Go
- mattermost · Bitnami
The same CVE-2022-1385 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mattermost is an open-source messaging platform that enables secure team collaboration. It is written in Go and provides various features such as public and private channels, direct messaging, file sharing, and integrations. Mattermost versions 6.4.x and earlier are affected by a vulnerability that allows accidentally invited users to join the workspace and access information from public teams and channels.
Vulnerability Detail
The vulnerability in Mattermost arises from its failure to properly invalidate pending email invitations when the action is performed from the system console. This oversight enables unintended users to join the workspace and gain unauthorized access to information within public teams and channels. The impact of this vulnerability can be significant, as it compromises the confidentiality and integrity of sensitive data shared within the affected workspace.
How To Fix
Latest published version: v6.7.2 as of 23 Oct 2026
go get github.com/mattermost/mattermost-server/v6@v6.7.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.5.0
This is the first release that contains the fix.
go get github.com/mattermost/mattermost-server/v6@v6.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Mattermost to mitigate the risk of unauthorized access.
Conclusion
The vulnerability in Mattermost, CVE-2022-1385, allows accidentally invited users to gain unauthorized access to the workspace and view information from public teams and channels. To mitigate this risk, it is crucial to upgrade to Mattermost version 6.5.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/mattermost/mattermost-server/v6 →
FAQ
Mattermost is an open-source messaging platform that facilitates secure team collaboration.
Mattermost versions 6.4.x and earlier are affected by this vulnerability.
This vulnerability allows accidentally invited users to join the workspace and access information from public teams and channels, compromising the confidentiality and integrity of sensitive data.
To fix this vulnerability, it is recommended to upgrade to Mattermost version 6.5.0 or later.
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/mattermost/mattermost-server/v6.
