Описание
Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.. Mattermost Advisory ID: MMSA-2026-00645
Ссылки
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 11.5.0 (включая) до 11.5.2 (исключая)
cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
EPSS
Процентиль: 11%
0.00205
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-862
Связанные уязвимости
CVSS3: 6.5
debian
3 месяца назад
Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership ...
CVSS3: 6.5
github
3 месяца назад
Mattermost doesn't verify channel membership when processing AI-assisted message rewrites
EPSS
Процентиль: 11%
0.00205
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-862