Description
The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | unspecified – ≤ 6.3.8, 6.4.x, 6.7.x 6.7.0, 6.5.x – ≤ 6.5.1, 6.6.x – ≤ 6.6.1 | — |