One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads.
Weakness
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mattermost | Mattermost | * | 6.4.0 (excluding) |