-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control (CWE-284) and cleartext storage (CWE-312) in shared channel contexts. Key functions were identified by analyzing: 1) Where user data sanitization occurs (SanitizeProfile), 2) Core user retrieval logic (GetUser), and 3) Serialization/redaction rules (GetSanitizedOptions). These areas align with the described failure to redact remote user emails despite configuration. Confidence is medium due to indirect inference from the vulnerability pattern, as no direct commit/patch data was available for verification.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | >= 9.9.0, < 9.9.2 | 9.9.2 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.5.0, < 9.5.8 | 9.5.8 |
| github.com/mattermost/mattermost/server/v8 |
| go |
| >= 9.10.0, < 9.10.1 |
| 9.10.1 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.8.0, < 9.8.3 | 9.8.3 |
Ongoing coverage of React2Shell