Mattermost Team Email Exposure Vulnerability

A vulnerability exists in Mattermost versions 11.0.x through 11.0.2, 10.12.x through 10.12.1, 10.11.x through 10.11.4, and 10.5.x through 10.5.12. These versions fail to properly restrict visibility of team email addresses, allowing any authenticated user to access this information through the 'GET /api/v4/channels/{channel_id}/common_teams' endpoint.

Impact

Exploitation of this vulnerability allows authenticated users to view team email addresses that should be restricted to Team Admins.

Remediation

Users can upgrade to Mattermost versions 11.2.0, 11.1.0, or 10.12.2 to address this vulnerability.