CVEvulnerability

CVE-2021-37864

6.5 MEDIUM Published 2022-01-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-01-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.6 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-284, CWE-863

Description

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.

Affected configurations

• mattermost mattermost (<= 6.1)

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-863 Incorrect Authorization weakness

References