CVE-2021-37864

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.
References
Link Resource
https://mattermost.com/security-updates/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-01-18 17:15

Updated : 2024-02-28 18:48


NVD link : CVE-2021-37864

Mitre link : CVE-2021-37864

CVE.ORG link : CVE-2021-37864


JSON object : View

Products Affected

mattermost

  • mattermost
CWE
CWE-863

Incorrect Authorization

CWE-284

Improper Access Control