-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the API handlers that return information about teams. Specifically, the functions getGroupMessageMembersCommonTeams and getDirectOrGroupMessageMembersCommonTeams in server/channels/api4/channel.go were identified as vulnerable. These functions handle API requests that provide lists of teams. Before the fix, the code would fetch the team data and immediately encode it as a JSON response. This team data included sensitive information, such as team email addresses, that should only be accessible to users with specific permissions (i.e., Team Admins). The vulnerability was that the code did not check the permissions of the user making the request before returning the sensitive data. The patch for this vulnerability was to introduce a call to c.App.SanitizeTeams. This function takes the user's session and the list of teams, and it filters out any sensitive information that the user is not authorized to see before the data is encoded and sent in the response. Therefore, any authenticated user could exploit this vulnerability to access the email addresses of any team.
api4.getGroupMessageMembersCommonTeamsserver/channels/api4/channel.go
api4.getDirectOrGroupMessageMembersCommonTeamsserver/channels/api4/channel.go
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20251015091448-abbf01b9db45 | 8.0.0-20251015091448-abbf01b9db45 |
| github.com/mattermost/mattermost-server | go | >= 11.0.0, < 11.0.3 | 11.0.3 |
| github.com/mattermost/mattermost-server | go | >= 10.12.0, < 10.12.2 | 10.12.2 |
| github.com/mattermost/mattermost-server | go | >= 10.11.0, < 10.11.5 | 10.11.5 |
| github.com/mattermost/mattermost-server | go | >= 10.5.0, < 10.5.13 | 10.5.13 |
Ongoing coverage of React2Shell