Mattermost Vulnerability Allows Access to Private Channels

CVE-2024-42000

Summary

Certain versions of Mattermost exhibit a flaw in their authorization process related to the API endpoint /api/v4/channels. This vulnerability allows users or System Managers with 'Read Groups' permission, but without actual channel access, to retrieve information about private channels they do not belong to. Such unauthorized access can lead to potential privacy violations and compromise sensitive information, highlighting the importance of reviewing access controls and security measures in the affected versions.

References