GHSA-7ggc-5r84-xf54
Mattermost users could access some sensitive information via API call
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server/v6 | < 6.3.9 | 6.3.9 |
| Go | github.com/mattermost/mattermost-server/v6 | >= 6.4.0, < 6.5.2 | 6.5.2 |
| Go | github.com/mattermost/mattermost-server/v6 | >= 6.6.0, < 6.6.2 | 6.6.2 |
| Go | github.com/mattermost/mattermost-server/v6 | >= 6.7.0, < 6.7.1 | 6.7.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
References
External links from the advisory. They lead to third-party sites.