CVE-2023-27266

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response...

CVE-2023-27266

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response...

CVE-2023-27265

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response...

CVE-2023-27265

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response...

CVE-2023-27266

Mattermost vulnerability CVE-2023-27266 arises from the API response construction for /api/v4/users/me/teams not honoring ShowEmailAddress. This allows a user with team admin privileges to learn the team owner's email address from the response. Affected software: Mattermost (web/API level). Root ...

CVE-2023-27265

CVE-2023-27265 affects Mattermost. The issue arises when regenerating Invite IDs: the system fails to honor the ShowEmailAddress setting, causing the team owner’s email address to be returned in the API response. This leakage is exposed to an attacker with team admin privileges who can trigger th...