Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2023-48732

Keywords that trigger mentions are leaked to other users

Description

Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 0 to ≤ 8.1.6affected
  • 8.1.7unaffected

References