CVE-2024-11599

Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

History

01 Oct 2025, 18:25

Type	Values Removed	Values Added
References	~~() https://mattermost.com/security-updates -~~	() https://mattermost.com/security-updates - Vendor Advisory
CPE		cpe:2.3:a:mattermost:mattermost_server::::::::
Summary		(es) Las versiones de Mattermost 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 no logran validar correctamente las direcciones de correo electrónico, lo que permite que un usuario no autenticado eluda las restricciones de dominio de correo electrónico mediante una entrada cuidadosamente manipulada en el registro de correo electrónico.
First Time		Mattermost Mattermost mattermost Server

28 Nov 2024, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-28 10:15

Updated : 2025-10-01 18:25

NVD link : CVE-2024-11599

Mitre link : CVE-2024-11599

CVE.ORG link : CVE-2024-11599

JSON object : View

Products Affected

mattermost

mattermost_server

CWE

CWE-754

Improper Check for Unusual or Exceptional Conditions

{"id": "CVE-2024-11599", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-11-28T10:15:06.657", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration."}, {"lang": "es", "value": "Las versiones de Mattermost 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 no logran validar correctamente las direcciones de correo electr\u00f3nico, lo que permite que un usuario no autenticado eluda las restricciones de dominio de correo electr\u00f3nico mediante una entrada cuidadosamente manipulada en el registro de correo electr\u00f3nico."}], "lastModified": "2025-10-01T18:25:03.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCC5F47D-C2DB-43F7-ACD1-818BB90B92B3", "versionEndExcluding": "9.5.12", "versionStartIncluding": "9.5.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "248F920B-1EE2-40BD-876D-B485CC7E542E", "versionEndExcluding": "9.11.4", "versionStartIncluding": "9.11.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45091AE5-AA1E-4AA7-BF77-7A44D0F65626", "versionEndExcluding": "10.0.2", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08B91DB1-AC84-4446-86C3-30F796AE8EEB", "versionEndExcluding": "10.1.2", "versionStartIncluding": "10.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}