CVE-2023-47858: Mattermost Server Viewing Archived Public Channels Permissions Vulnerability
Summary
CVE-2023-47858: Mattermost viewing archived public channels permissions vulnerability. Affects github.com/mattermost/mattermost-server/v6 versions < 7.8.10. Fixed in 7.8.10. How to fix ↓
Also tracked for
- github.com/mattermost/mattermost-server · Go
- mattermost · Bitnami
The same CVE-2023-47858 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mattermost Server is an open-source messaging platform that allows teams to collaborate and communicate effectively. It is written in Go and provides various features such as public and private channels, direct messaging, file sharing, and more. However, a vulnerability has been discovered in Mattermost Server that affects the viewing of archived public channels.
Vulnerability Detail
The vulnerability in Mattermost Server arises from a failure to properly verify the permissions required for viewing archived public channels. This flaw allows a member of one team to gain access to details about the archived public channels of another team by exploiting the GET /api/v4/teams/<team-id>/channels/deleted endpoint. This vulnerability can lead to unauthorized access to sensitive information and potential data leakage between teams.
How To Fix
Latest published version: v6.7.2 as of 23 Oct 2026
go get github.com/mattermost/mattermost-server/v6@v6.7.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.8.10
This is the first release that contains the fix.
go get github.com/mattermost/mattermost-server/v6@v7.8.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched versions of Mattermost Server.
Conclusion
The vulnerability in Mattermost Server allows unauthorized access to archived public channels of other teams, potentially leading to the exposure of sensitive information and data leakage. It is crucial to upgrade to the latest patched versions of Mattermost Server (7.8.10 for v6 and 8.1.1 for v8) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/mattermost/mattermost-server/v6 →
FAQ
The vulnerability allows unauthorized access to archived public channels of other teams, potentially leading to the exposure of sensitive information and data leakage.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground, and it will alert you in real-time if your installation is vulnerable.
No, only versions up to and including 7.8.9 for Mattermost Server v6 and versions up to and including 8.1.0 for Mattermost Server v8 are affected. Upgrading to the latest patched versions will resolve the vulnerability.
There is no evidence of this vulnerability being actively exploited at the time of discovery. However, it is crucial to apply the recommended fix to prevent any potential exploitation.
You can find more information about this vulnerability, including its technical details and the fixed versions, in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-w88v-pjr8-cmv2/GHSA-w88v-pjr8-cmv2.json
Related vulnerabilities
Recent vulnerabilities recorded for github.com/mattermost/mattermost-server/v6.
