GHSA-3wq5-3f56-v5xcMediumCVSS 5.3

Mattermost vulnerable to information disclosure

Published
March 31, 2023
Last Modified
July 25, 2025

🔗 CVE IDs covered (1)

CVE-2023-1777 →

📋 Description

Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.

🎯 Affected products6

  • go/github.com/mattermost/mattermost-server/v6:>= 6.3.0, <= 6.7.2
  • go/github.com/mattermost/mattermost-server:= 7.8.0
  • go/github.com/mattermost/mattermost-server:>= 7.7.0, <= 7.7.1
  • go/github.com/mattermost/mattermost-server:>= 7.1.0, <= 7.1.5
  • go/github.com/mattermost/mattermost-server/v6:>= 6.0.0-20211025164829-f7a8147b825c, < 6.0.0-20230301145909-10be118d99a5
  • go/github.com/mattermost/mattermost-server:>= 1.4.1-0.20211025164829-f7a8147b825c, < 1.4.1-0.20230301145909-10be118d99a5

🔗 References (3)