CVE-2023-2787

Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API...

CVE-2024-29215 Slash commands run in channel without channel membership via playbook task commands

Mattermost versions 9.5.x = 9.5.3, 9.7.x = 9.7.1, 9.6.x = 9.6.1, 8.1.x = 8.1.12 fail to enforce proper access control which allows a user to run a slash command in a channel they are not a member of via linking a playbook run to that channel and running a slash command as a playbook task command...

CVE-2024-32045 Playbook run link to private channel grants channel access

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1, 8.1.x = 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows members to link their runs to private channels they were not members of...

BIT-MATTERMOST-2023-3582

Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to,...

Design/Logic Flaw

Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to,...

CVE-2023-3582 Lack of channel membership check when linking a board to a channel

Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to,...

CVE-2023-3582 Lack of channel membership check when linking a board to a channel

Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to,...

CVE-2023-3582 Lack of channel membership check when linking a board to a channel

Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to,...

CVE-2023-3582

CVE-2023-3582 in Mattermost describes a failure to verify channel membership when linking a board to a channel. A low-privileged authenticated user can link a Board to a private channel they should not access, potentially exposing restricted content or altering channel-board associations. The ava...

Code injection

Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API...

CVE-2023-2787 Collapsed Reply Threads APIs leak message contents from private channels

Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API...

CVE-2023-2787

Mattermost is affected by CVE-2023-2787: a channel membership check failure when accessing message threads allows viewing posts via the Message Threads API. The root cause is an access control error that does not verify identity of channel members for message-thread access, potentially exposing c...

PT-2023-21384 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue allows an attacker to access arbitrary posts by using the message threads API, as Mattermost fails to check channel membership when accessing message threads. Recommendations: ...