GHSA-hwjf-4667-gqwx
Mattermost allows attackers access to posts in channels they are not a member of
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost/server/v8 | >= 9.3.0, < 9.3.1 | 9.3.1 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 9.2.0, < 9.2.5 | 9.2.5 |
| Go | github.com/mattermost/mattermost/server/v8 | < 8.1.9 | 8.1.9 |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.
References
External links from the advisory. They lead to third-party sites.