| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-server/v6 | < 7.8.13 | 7.8.13 |
| github.com/mattermost/mattermost/server/v8 | ≥ 9.0.0, < 9.0.2≥ 9.1.0, < 9.1.1< 8.1.4 | 9.0.29.1.18.1.4 |
| mattermost | ≥ 8.0.0, ≤ 8.1.3≤ 7.8.12 |
Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free