CVE-2021-37864
Users can view the contents of an archived channel when access is explicitly denied by the system admin
- State
- Published
- Severity
- 2.6 Low
- Published
- Jan 18, 2022
- Updated
- Dec 6, 2024
- Reserved
- Aug 2, 2021
Description
Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 2.6 Low | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N | Mattermost |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
MattermostMattermost |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.