CVE-2023-27265
Disclosure of team owner email address when regenerating Invite ID
Summary
Disclosure of team owner email address when regenerating Invite ID
Original description
The description as published by the source.
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com