CVE-2024-29977

Malicious remote can create arbitrary reactions on arbitrary posts

2.7 LowFix available

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remote to create arbitrary reactions on arbitrary posts

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.28%Up 0.2 points since Aug 2, 2024

What each source reports

CVE List Score used 2.7

Malicious remote can create arbitrary reactions on arbitrary posts

Record: CVE-2024-29977
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2024-2607 2.7

Record: EUVD-2024-2607
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jq3g-xqpx-37x3 5.1

Mattermost failed to properly validate synced reactions

Record: GHSA-jq3g-xqpx-37x3
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

NVD 2.7

Record: CVE-2024-29977
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

OSV 2.7

Malicious remote can create arbitrary reactions on arbitrary posts

Record: CVE-2024-29977
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

OSVGHSA-jq3g-xqpx-37x3 5.1

Mattermost failed to properly validate synced reactions

Record: GHSA-jq3g-xqpx-37x3
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

OSVGO-2024-3030 No score

Mattermost failed to properly validate synced reactions in github.com/mattermost/mattermost-server

Mattermost failed to properly validate synced reactions in github.com/mattermost/mattermost-server

Record: GO-2024-3030
Updated: 2026-11-02

Affected products

mattermost

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/mattermost/mattermost/server/v8` Go	9.5.0 up to 9.5.7	9.5.7
`github.com/mattermost/mattermost/server/v8` Go	9.9.0 to 9.9.0	9.9.1
`github.com/mattermost/mattermost/server/v8` Go	9.9.0 up to 9.9.1	9.9.1
`github.com/mattermost/mattermost-server` Go	9.5.0+incompatible up to 9.5.7+incompatible, 9.9.0+incompatible up to 9.9.1+incompatible	9.5.7+incompatible9.9.1+incompatible
`github.com/mattermost/mattermost-server/v5` Go	All versions	None known
`github.com/mattermost/mattermost-server/v6` Go	All versions	None known
`github.com/mattermost/mattermost/server/v8` Go	All versions	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-29977 is a low vulnerability (CVSS 2.7) in Mattermost, published August 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in github.com/mattermost/mattermost/server/v8 9.5.7.