CVE-2023-47858: Mattermost Server

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Mattermost fails to properly verify the permissions needed for viewing archived public channels,  allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams/<team-id>/channels/deleted endpoint.

Affected products

• Mattermost Mattermost Server: before 8.1.7 (fixed in 8.1.7); from 9.0.0, before 9.0.5 (fixed in 9.0.5); from 9.1.0, before 9.1.4 (fixed in 9.1.4); from 9.2.0, before 9.2.3 (fixed in 9.2.3)

Published 2024-01-02. Last modified 2026-06-17.