CVE-2023-27265
Disclosure of team owner email address when regenerating Invite ID
Résumé
Disclosure of team owner email address when regenerating Invite ID
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com