CVE-2023-27266
Disclosure of team owner email address when when accessing the teams API
概要
Disclosure of team owner email address when when accessing the teams API
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com