CVE-2023-27266
Disclosure of team owner email address when when accessing the teams API
Résumé
Disclosure of team owner email address when when accessing the teams API
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com