未評価
Guest users can bypass read permissions via search API
CVE-2026-24692
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory mattermost.com
- advisory nvd.nist.gov