An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation.
During installation, installed file permissions are set to allow anyone to modify those files.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mattermost_server | Mattermost | 4.10.0 (including) | 4.10.5 (excluding) |
| Mattermost_server | Mattermost | 5.5.0 (including) | 5.5.2 (excluding) |
| Mattermost_server | Mattermost | 5.6.0 (including) | 5.6.3 (excluding) |
| Mattermost_server | Mattermost | 5.7.0-rc1 (including) | 5.7.0-rc1 (including) |
| Mattermost_server | Mattermost | 5.7.0-rc2 (including) | 5.7.0-rc2 (including) |
| Mattermost_server | Mattermost | 5.7.0-rc3 (including) | 5.7.0-rc3 (including) |
| Mattermost_server | Mattermost | 5.7.0-rc4 (including) | 5.7.0-rc4 (including) |
| Mattermost_server | Mattermost | 5.7.0-rc5 (including) | 5.7.0-rc5 (including) |
| Mattermost_server | Mattermost | 5.7.0-rc6 (including) | 5.7.0-rc6 (including) |