CVE-2023-27265 Disclosure of team owner email address when regenerating Invite ID

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response...

CVE-2023-27265 Disclosure of team owner email address when regenerating Invite ID

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response...

CVE-2023-27265

CVE-2023-27265 affects Mattermost. The issue arises when regenerating Invite IDs: the system fails to honor the ShowEmailAddress setting, causing the team owner’s email address to be returned in the API response. This leakage is exposed to an attacker with team admin privileges who can trigger th...