Description (CNA)
Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1 and 8.1.x <= 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/<group-id>/channels/<channel-id>/link endpoint which allows a user to learn the members of an AD/LDAP group that is linked to a team by adding the group to a channel, even if the user has no access to the team.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Mattermost / Mattermost | affected 9.5.0 through 9.5.3; affected 9.7.0 through 9.7.1; affected 8.1.0 through 8.1.12; unaffected 9.8.0; unaffected 9.5.4; unaffected 9.7.2; unaffected 8.1.13 |
CWE
CWE-200
References
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.