CVE-2025-47870
Team invite ID leaked to team admin with no member invite privileges
概要
Team invite ID leaked to team admin with no member invite privileges
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com