LOW3.1
GHSA-xgxj-j98c-59rv
Mattermost fails to properly restrict the access of files attached to posts
Quick fix
GHSA-xgxj-j98c-59rv — github.com/mattermost/mattermost/server/v8: upgrade to the fixed version with the command below.
go get github.com/mattermost/mattermost/server/v8@v9.4.2Details
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/mattermost/mattermost/server/v8
Introduced in:
9.0.0Fixed in: 9.4.2Fix
go get github.com/mattermost/mattermost/server/v8@v9.4.2Go/github.com/mattermost/mattermost/server/v8
Introduced in:
0Fixed in: 8.1.9Fix
go get github.com/mattermost/mattermost/server/v8@v8.1.9