VULNERABILITY INTELLIGENCE

CVE-2021-37864

CVSS score2.6 LOW
EPSS probability0.58%
CISA KEVNot currently listed
Published2022-01-18
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Description

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.

Weakness classification

  • CWE-284: Improper Access Control
  • CWE-863: Incorrect Authorization

Primary references