-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20250905150616-ba86dfc5876b | 8.0.0-20250905150616-ba86dfc5876b |
| github.com/mattermost/mattermost | go | >= 10.11.0, < 10.11.5 | 10.11.5 |
| github.com/mattermost/mattermost | go | >= 10.5.0, < 10.5.13 | 10.5.13 |
Miggo AIRoot Cause AnalysisThe vulnerability is an information disclosure issue within the Mattermost server API. Several API endpoints that return channel member information were not properly sanitizing the output. Specifically, the LastViewedAt and LastUpdateAt timestamps for channel members were exposed to any authenticated user who could query these endpoints. This leaked information about user activity.
The patch introduces a new method, SanitizeForCurrentUser, on the ChannelMember model. This method checks if the channel member data being requested belongs to the current user. If not, it redacts the sensitive LastViewedAt and LastUpdateAt fields by setting them to -1.
This sanitization logic was then applied to multiple API handlers in server/channels/api4/channel.go and server/channels/api4/user.go, including getChannelMembers, getChannelMembersByIds, getChannelMember, getChannelMembersForTeamForUser, addChannelMember, and getChannelMembersForUser. Before the patch, these functions were the sources of the information leak.
While the vulnerability description mentions improper access control related to "Boards" (accessing files and subscribing to blocks), the provided patch only addresses the information disclosure of channel member activity. It's possible that this information leak could be a contributing factor to a more complex attack chain targeting Boards, or that the description is a broader summary of a security release that included multiple fixes. Based purely on the provided commit, the direct vulnerability is the information disclosure.
api4.getChannelMembersserver/channels/api4/channel.go
api4.getChannelMembersByIdsserver/channels/api4/channel.go
api4.getChannelMemberserver/channels/api4/channel.go
api4.getChannelMembersForTeamForUserserver/channels/api4/channel.go
api4.addChannelMemberserver/channels/api4/channel.go
api4.getChannelMembersForUserserver/channels/api4/user.go
Ongoing coverage of React2Shell