CVE-2023-27266
Disclosure of team owner email address when when accessing the teams API
Summary
Disclosure of team owner email address when when accessing the teams API
Original description
The description as published by the source.
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com