CVE-2021-37867

Emails of all users are exposed via one of the Boards APIs

State: Published
Severity: 4.3 Medium
Published: Jan 18, 2022
Updated: Dec 6, 2024
Reserved: Aug 2, 2021

Description

Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	Mattermost

Weaknesses

CWE-200 Information Exposure

Affected Products

Product	Versions
Mattermost BoardsMattermost	0.10.0 and earlierAffected 0.9.5 to before unspecifiedNot affected 0.8.4 to before unspecifiedNot affected 0.7.5 to before unspecifiedNot affected

References

https://mattermost.com/security-updates/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.