未評価
Private channel enumeration via /mute slash command
CVE-2026-21386
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels. Mattermost Advisory ID: MMSA-2026-00588
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory mattermost.com
- advisory nvd.nist.gov