VDB
Sign up
LOW3.1

GHSA-r833-w756-h5p2

Mattermost fails to check the required permissions

Quick fix

GHSA-r833-w756-h5p2 — github.com/mattermost/mattermost/server/v8: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost/server/v8@v8.1.8

Details

Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without permissions.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost/server/v8
Introduced in: 0Fixed in: 8.1.8
Fixgo get github.com/mattermost/mattermost/server/v8@v8.1.8
Go/github.com/mattermost/mattermost/server/v8
Introduced in: 9.0.0Fixed in: 9.3.0
Fixgo get github.com/mattermost/mattermost/server/v8@v9.3.0

References