CVE-2023-2787CWE-862

Collapsed Reply Threads APIs leak message contents from private channels

Medium · published June 16, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00540 · 44.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-06-16T08:55Z
EPSS history
Timeline
  • 16 JUN 08:55Z
    Collapsed Reply Threads APIs leak message contents from private channels
    cvelistv5