GO-2026-6286 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel in github.com/mattermost/mattermost-server

Mattermost doesn't restrict roleupdated websocket event broadcasts to members of the affected team or channel in github.com/mattermost/mattermost-server...

GHSA-RP4V-QC77-PHM4 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 fail to restrict roleupdated websocket event broadcasts to members of the affected team or channel, which allows an authenticated attacker with guest-level access to observe permission scheme change...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the roleupdated websocket event broadcast process. An attacker can gain unauthorized access to permission scheme change notifications for private teams by connecting to the websocket as an authenticated user wit...