CVE-2023-27265CWE-200

Disclosure of team owner email address when regenerating Invite ID

Low · published February 27, 2023

CVSS v3.1
2.7
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00526 · 43.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-02-27T14:46Z
EPSS history
Timeline
  • 27 FEB 14:46Z
    Disclosure of team owner email address when regenerating Invite ID
    cvelistv5