Emails of all users are exposed via one of the Boards APIs
Priority LOW 21CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00672 52nd percentileScored 2026-11-07
Fix Fixed Mattermost Boards (Mattermost): 0.9.5, 0.8.4, 0.7.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mattermost | Mattermost Boards | up to 0.10.0 | 0.9.5, 0.8.4, 0.7.5 | Patch available | CNA |
- Mattermost Boards VendorMattermost Affected up to 0.10.0 Fixed in 0.9.5, 0.8.4, 0.7.5 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mattermost:mattermost_boards:*:*:*:*:*:*:*:* | up to 0.10.0 | Vulnerable | Mattermost |
- cpe:2.3:a:mattermost:mattermost_boards:*:*:*:*:*:*:*:* Versions up to 0.10.0 Vulnerable ·Mattermost
Remediation
- Fix · CNA Mattermost Boards (Mattermost) Fixed in 0.9.5, 0.8.4, 0.7.5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Mattermost Boards unspecified
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-15667 Session is not invalidated on server-side when user logged out of BoardsPriority LOW 34
Timeline
- 2026-10-02 Threatist record created from CVE-2021-37867
- 2026-10-03 Alias added: GHSA-gwpj-7fq2-hfw2
References
Advisory 1
More Mattermost Boards vulnerabilities
- TI-2021-15667 Session is not invalidated on server-side when user logged out of Boards CVSS 3.1HIGH 7.5
Sources
- CVE-2021-37867 · CVE Program
- CVE-2021-37867 · NVD
- FIRST EPSS
- GHSA-gwpj-7fq2-hfw2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences