CVE-2023-27266: Mattermost Server

Low severity, CVSS 2.7. EPSS: 0.5% chance of exploitation in the next 30 days.

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.

Affected products

• Mattermost Mattermost Server: from 5.12.0, before 7.7.0 (fixed in 7.7.0)

Published 2023-02-27. Last modified 2026-06-17.