Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of access controls in the channel members API endpoint. An attacker can gain unauthorised access to metadata about members of public channels as a guest user by exploiting this securit...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of access controls in the channel members API endpoint. An attacker can gain unauthorised access to metadata about members of public channels as a guest user by exploiting this securit...

CVE-2025-1792

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

CVE-2025-1792

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

CVE-2025-1792

CVE-2025-1792 affects Mattermost Server: 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x

CVE-2025-1792 Improper Access Control in Mattermost Channel Member API

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

CVE-2025-1792 Improper Access Control in Mattermost Channel Member API

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

CVE-2025-1792: Incorrect Authorization

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

CVE-2023-28357

A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...

PT-2023-21667 · Rocket.Chat · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat affected versions not specified Description: A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command "/mute" occur after checking whether a user is a member of a given channel, leaking private...

Rocket.Chat information leakage vulnerability

Rocket.Chat is an open source team chat software. An information disclosure vulnerability exists in versions prior to Rocket.Chat 6.0, which stems from an ACL check in the slash command /mute, after checking if a user is a member of a given channel, which can disclose private channel members to...

CVE-2023-28357

A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...

Rocket.Chat getRoomRoles Meteor Information Disclosure Vulnerability

Rocket.Chat is an open source team chat software. An information disclosure vulnerability exists in Rocket.Chat versions prior to 4.7.5, 4.8.0 and later, and prior to 4.8.2, which stems from a lack of ACL checking in its getRoomRoles Meteor method, and can be exploited by an attacker to cause a...

Information disclosure

A information disclosure vulnerability exists in Rocket.chat v5, v4.8.2 and v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients...

CVE-2022-35247

A information disclosure vulnerability exists in Rocket.chat v5, v4.8.2 and v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients...

CVE-2022-35247

A information disclosure vulnerability exists in Rocket.chat v5, v4.8.2 and v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients...

CVE-2022-35247

A information disclosure vulnerability exists in Rocket.chat v5, v4.8.2 and v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients...