Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.
Solution:
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
| Link | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor advisory |