-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from missing access control checks during permalink preview generation. The primary suspect is the permalink preview handler (app.GetPermalinkPreview) which would be responsible for channel visibility checks. The medium-confidence entry (app.GetChannel) reflects the possibility that the channel retrieval function might not properly enforce archived channel visibility rules in all contexts. The confidence stems from the vulnerability's description specifically mentioning the missing check during permalink previews, which would typically involve these core channel interaction functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | >= 9.1.0, < 9.1.1 | 9.1.1 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.0.0, < 9.0.2 | 9.0.2 |
| github.com/mattermost/mattermost/server/v8 |
| go |
| < 8.1.4 |
| 8.1.4 |
| github.com/mattermost/mattermost-server/v6 | go | < 7.8.13 | 7.8.13 |
Ongoing coverage of React2Shell