Read the docs
TI-2023-26229 Aliases CVE-2023-48369GHSA-3487-3j7c-7gwj

Log Flooding due to specially crafted requests in different endpoints

Priority LOW 25CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.

Why it matters now

EPSS 0.00632 50th percentileScored 2026-11-07
Fix Fixed Mattermost (Mattermost): 9.0.2, 9.1.1, 7.8.13 +1github.com/mattermost/mattermost/server/v8 (Go): 9.1.1, 9.0.2, 8.1.4+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MattermostMattermostup to 7.8.12; up to 8.1.3; up to 9.0.1; up to 9.1.09.0.2, 9.1.1, 7.8.13, 8.1.4Patch availableCNA
—github.com/mattermost/mattermost/server/v8 (Go)9.1.0 to before 9.1.19.1.1Patch availableGHSA-3487-3j7c-7gwj
—github.com/mattermost/mattermost/server/v8 (Go)9.0.0 to before 9.0.29.0.2Patch availableGHSA-3487-3j7c-7gwj
—github.com/mattermost/mattermost/server/v8 (Go)before 8.1.48.1.4Patch availableGHSA-3487-3j7c-7gwj
—github.com/mattermost/mattermost-server/v6 (Go)before 7.8.137.8.13Patch availableGHSA-3487-3j7c-7gwj
  • Mattermost VendorMattermost Affected up to 7.8.12; up to 8.1.3; up to 9.0.1; up to 9.1.0 Fixed in 9.0.2, 9.1.1, 7.8.13, 8.1.4 Patch available CNA
  • github.com/mattermost/mattermost/server/v8 (Go) Vendor— Affected 9.1.0 to before 9.1.1 Fixed in 9.1.1 Patch available GHSA-3487-3j7c-7gwj
  • github.com/mattermost/mattermost/server/v8 (Go) Vendor— Affected 9.0.0 to before 9.0.2 Fixed in 9.0.2 Patch available GHSA-3487-3j7c-7gwj
  • github.com/mattermost/mattermost/server/v8 (Go) Vendor— Affected before 8.1.4 Fixed in 8.1.4 Patch available GHSA-3487-3j7c-7gwj
  • github.com/mattermost/mattermost-server/v6 (Go) Vendor— Affected before 7.8.13 Fixed in 7.8.13 Patch available GHSA-3487-3j7c-7gwj

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*up to 7.8.12; 8.0.0 – 8.1.3; 9.0.0 – 9.0.1VulnerableMattermost
cpe:2.3:a:mattermost:mattermost:9.1.0:*:*:*:*:*:*:*9.1.0VulnerableMattermost
  • cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* Versions up to 7.8.12; 8.0.0 – 8.1.3; 9.0.0 – 9.0.1 Vulnerable ·Mattermost
  • cpe:2.3:a:mattermost:mattermost:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Mattermost

Remediation

  • Fix · CNA Mattermost (Mattermost) Fixed in 9.0.2, 9.1.1, 7.8.13, 8.1.4
  • Fix · GHSA-3487-3j7c-7gwj github.com/mattermost/mattermost/server/v8 (Go) Fixed in 9.1.1 Advisory →
  • Fix · GHSA-3487-3j7c-7gwj github.com/mattermost/mattermost/server/v8 (Go) Fixed in 9.0.2 Advisory →
  • Fix · GHSA-3487-3j7c-7gwj github.com/mattermost/mattermost/server/v8 (Go) Fixed in 8.1.4 Advisory →
  • Fix · GHSA-3487-3j7c-7gwj github.com/mattermost/mattermost-server/v6 (Go) Fixed in 7.8.13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-48369
  2. 2026-10-03 Alias added: GHSA-3487-3j7c-7gwj
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 1

  • TI-2024-26695 Malicious remote can invite itself to an arbitrary local channel CVSS 3.1CRITICAL 9.6
  • TI-2023-02056 Oauth authorization codes do not expire when deauthorizing an oauth2 app CVSS 3.1CRITICAL 9.1
  • TI-2019-15069 An issue was discovered in Mattermost Mobile Apps before 1.26.0. CVSS 3.1CRITICAL 9.1
  • TI-2024-26233 Malicious remote can add users to arbitrary teams and channels CVSS 3.1HIGH 8.7
  • TI-2024-26746 Permanently local data deletion by malicious remote CVSS 3.1HIGH 8.7
  • TI-2023-06508 Injection in Mattermost CVSS 3.1HIGH 8.8
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences