CVE-2024-32045
Playbook run link to private channel grants channel access
Summary
Playbook run link to private channel grants channel access
Original description
The description as published by the source.
Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows members to link their runs to private channels they were not members of.
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com