Skip to content
OpenAdvisories
Medium · 6.5 CVE-2023-2787 EUVD-2023-34243GHSA-8m2w-p6c5-hh6c

Collapsed Reply Threads APIs leak message contents from private channels

Published Jun 16, 2023 · Updated Dec 6, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost

Description

Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 7.9.3, ≤ 7.8.4, ≤ 7.1.9, 7.10.0 7.9.3

References