CVE-2023-5193 — System Role with manage posts permission can read posts of Direct Messages

CVE-2023-5193

System Role with manage posts permission can read posts of Direct Messages PUBLISHED

Description (CNA)

Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 through 8.0.1; affected 0 through 7.8.9; affected 8.1.0; unaffected 8.0.2; unaffected 8.1.1; unaffected 7.8.10

CWE

CWE-863

References

https://mattermost.com/security-updates

ADP enrichment

CVE

No English description supplied.

https://mattermost.com/security-updates

CISA-ADP

No English description supplied.

No references supplied.