9 matches found
CVE-2026-4286: Incorrect Authorization
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to check if teamid was being changed when updating playbooks, allowing users with only Manage Playbook Configurations permission to change a playbook's team, bypassing manage members restriction via PUT api. Mattermost Advisory ID:...
CVE-2026-32252: Improper Authorization
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:teamid/template/generate/:projectid. The GET handler calls checkAccessreq,...
CVE-2025-41443: Missing Authorization
Mattermost versions 10.5.x = 10.5.12, 10.11.x = 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/teamid/channels/ids endpoint...
EUVD-2011-0532
Malware in sbrugna...
CVE-2025-4128: Incorrect Authorization
Mattermost versions 10.5.x = 10.5.4, 9.11.x = 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/teamid...
CVE-2023-5160
CVE-2023-5160 : Mattermost fails to enforce the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint, enabling disclosure of a user’s full name even when the option is disabled. Connected sources confirm the vulnerability but do not provide concrete affected versions, root...
CVE-2023-5160: Exposure of Sensitive Information to an Unauthorized Actor
Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAMID/top/teammembers endpoint allowing a member to get the full name of another user even if the Show Full Name option was disabled...
