Skip to content
OpenAdvisories
Medium · 4.3 CVE-2023-47858 BIT-mattermost-2023-47858EUVD-2024-0444GHSA-w88v-pjr8-cmv2GO-2024-2450

Details of archived public channels are leaked to members of another team

Published Jan 2, 2024 · Updated Jun 17, 2025 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server Package: github.com/mattermost/mattermost-server/v5 Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server/v8 Ecosystem: Go

Description

Mattermost fails to properly verify the permissions needed for viewing archived public channels,  allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams/<team-id>/channels/deleted endpoint.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 9.2.2, ≤ 9.1.3, ≤ 9.0.4, ≤ 8.1.6 8.1.7

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server all versions — GO-2024-2450
Go github.com/mattermost/mattermost-server/v5 all versions — GO-2024-2450
Go github.com/mattermost/mattermost-server/v6 < 7.8.10 7.8.10 GHSA-w88v-pjr8-cmv2
Go github.com/mattermost/mattermost-server/v6 all versions — GO-2024-2450
Go github.com/mattermost/mattermost/server/v8 < 8.1.1 8.1.1 GHSA-w88v-pjr8-cmv2
Go github.com/mattermost/mattermost/server/v8 all versions — GO-2024-2450

References