---
id: CVE-2024-1949
aliases:
  - GHSA-3g35-v53r-gpxc
  - BIT-mattermost-2024-1949
  - GO-2024-2588
title: Mattermost race condition
summary: Mattermost race condition
severity: low
cvss: 2.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N'
vendor: mattermost
product: github.com/mattermost/mattermost/server/v8
ecosystem: go
affected:
  - 'github.com/mattermost/mattermost/server/v8 >= 9.0.0, < 9.4.2'
  - github.com/mattermost/mattermost/server/v8 < 8.1.9
patched:
  - github.com/mattermost/mattermost/server/v8 9.4.2
  - github.com/mattermost/mattermost/server/v8 8.1.9
published: '2024-02-29'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:05.203584845Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3g35-v53r-gpxc'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-1949'
  - url: 'https://github.com/mattermost/mattermost'
  - url: 'https://mattermost.com/security-updates'
  - url: 'https://pkg.go.dev/vuln/GO-2024-2588'
tags:
  - osv
  - go
epss: 0.00266
epssPercentile: 0.18773
ingestedAt: '2026-09-12T03:13:01.749Z'
---

## Overview

A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.



## Affected packages

- `github.com/mattermost/mattermost/server/v8 >= 9.0.0, < 9.4.2`
- `github.com/mattermost/mattermost/server/v8 < 8.1.9`

## Remediation

Upgrade to a patched release:

- `github.com/mattermost/mattermost/server/v8 9.4.2`
- `github.com/mattermost/mattermost/server/v8 8.1.9`