CVE-2022-2401: Mattermost Server

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.

Affected products

• Mattermost Mattermost Server: before 6.3.9 (fixed in 6.3.9); from 6.4.0, before 6.5.2 (fixed in 6.5.2); version 6.6.0 only; version 6.6.1 only; version 6.7.0 only

Published 2022-07-14. Last modified 2026-06-17.