Information Disclosure Vulnerability in Mattermost Platform

CVE-2025-47871

What is CVE-2025-47871?

The vulnerability in Mattermost arises from inadequate validation of channel membership when retrieving metadata for playbook runs. This allows authenticated users, who are part of a playbook but not members of a specific channel, to gain access to sensitive information linked to private channels. Information such as channel names, display names, and participant counts might be exposed through the run metadata API endpoint, which poses a security risk to user privacy and data integrity.

References