CVE-2023-2787: Collapsed Reply Threads APIs leak message contents from private channels
Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID of this Mattermost vulnerability?
The vulnerability ID of this Mattermost vulnerability is CVE-2023-2787.
What is the severity of CVE-2023-2787?
The severity of CVE-2023-2787 is medium with a CVSS score of 6.5.
How does Mattermost fail to check channel membership when accessing message threads?
Mattermost fails to check channel membership when accessing message threads by not verifying if the user is a member of the channel before granting access to message threads.
What can an attacker do with this vulnerability?
An attacker can access arbitrary posts by using the message threads API, bypassing the required channel membership check.
Which versions of Mattermost are affected by this vulnerability?
Versions 7.1.0 to 7.1.9, 7.8.0 to 7.8.4, 7.9.0 to 7.9.3, and 7.10.0 of Mattermost are affected by this vulnerability.
How can I fix CVE-2023-2787?
To fix CVE-2023-2787, it is recommended to upgrade to a version of Mattermost that is not affected by this vulnerability, as provided in the official security updates.