CVE-2023-48732: Mattermost Server

Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.

Affected products

• Mattermost Mattermost Server: before 8.1.7 (fixed in 8.1.7)

Published 2024-01-02. Last modified 2026-06-17.