Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Mattermost 7.7.0 Clear all filters
TI-2023-12016 CVE-2023-27266 · GHSA-cxwh-9cmm-77cp

Disclosure of team owner email address when when accessing the teams API

Priority LOW 14

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in t…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00526 Published 2023-02-27 Fixed in 7.7.0 CWE-200
TI-2023-12015 CVE-2023-27265 · GHSA-x444-p8vv-928w

Disclosure of team owner email address when regenerating Invite ID

Priority LOW 14

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in t…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00526 Published 2023-02-27 Fixed in 7.7.0 CWE-200