cve/2024/CVE-2024-39767.md

### [CVE-2024-39767](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39767)
![](https://img.shields.io/static/v1?label=Product&message=Mattermost&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%3A%20Improper%20Authentication&color=brightgreen)

### Description

Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another server’s diagnostic ID or server URL and have them show up in mobile apps as that server’s push notifications.

### POC

#### Reference
- https://mattermost.com/security-updates

#### Github
No PoCs found on GitHub currently.