---
id: CVE-2024-47003
aliases:
  - GHSA-59hf-mpf8-pqjh
  - BIT-mattermost-2024-47003
  - GO-2024-3164
title: >-
  Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted`
  events
summary: >-
  Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted`
  events
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
vendor: mattermost
product: github.com/mattermost/mattermost/server/v8
ecosystem: go
affected:
  - >-
    github.com/mattermost/mattermost/server/v8 <
    8.0.0-20240806094731-69a8b3df0f9f
patched:
  - github.com/mattermost/mattermost/server/v8 8.0.0-20240806094731-69a8b3df0f9f
published: '2024-09-26'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:55.966114175Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-59hf-mpf8-pqjh'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-47003'
  - url: 'https://github.com/mattermost/mattermost/pull/27763'
  - url: >-
      https://github.com/mattermost/mattermost/commit/69a8b3df0f9fd3a7a5b792ec678b6191618d039b
  - url: 'https://github.com/c0rydoras/cves/tree/main/CVE-2024-47003'
  - url: 'https://github.com/mattermost/mattermost'
  - url: 'https://mattermost.com/security-updates'
tags:
  - osv
  - go
epss: 0.00577
epssPercentile: 0.45214
ingestedAt: '2026-09-12T03:13:01.755Z'
---

## Overview

Mattermost does not strip `embeds` from `metadata` when broadcasting `posted` events.

This allows users to include arbitrary embeds in posts, which are then broadcasted via websockets. This can be exploited in many ways, for example to create permalinks with fully customizable content or to trigger a client Side Denial of Service (DoS) by sending a permalink with a non-string message.

The advisory metadata references the appropriate go pseudo version available from pkg.go.dev

## Affected packages

- `github.com/mattermost/mattermost/server/v8 < 8.0.0-20240806094731-69a8b3df0f9f`

## Remediation

Upgrade to a patched release:

- `github.com/mattermost/mattermost/server/v8 8.0.0-20240806094731-69a8b3df0f9f`