CVE-2023-2787 — Collapsed Reply Threads APIs leak message contents from private channels

CVE-2023-2787

Collapsed Reply Threads APIs leak message contents from private channels PUBLISHED

Description (CNA)

Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 through 7.9.3; affected 0 through 7.8.4; affected 0 through 7.1.9; affected 7.10.0; unaffected 7.9.3; unaffected 7.8.4; unaffected 7.1.9; unaffected 7.10.1

CWE

CWE-862

References

https://mattermost.com/security-updates/

ADP enrichment

CVE

No English description supplied.

https://mattermost.com/security-updates/

CISA-ADP

No English description supplied.

No references supplied.